What Caused the eMudhra Security Key Crisis? Company Report Explained
Photos

What Caused the eMudhra Security Key Crisis? Company Report Explained

Published on: 
eMudhra's Security Incident Raises Concerns

eMudhra's Security Incident Raises Concerns: Indian digital certificate provider eMudhra faced a major cybersecurity controversy after eight cryptographically weak keys were discovered in its certificate infrastructure. The incident raised concerns about website security and the reliability of digital certificates. On November 11, 2026, Business Today reported details from the company's incident report explaining the problem.

eMudhra operates as a Certificate Authority, issuing digital certificates that help browsers verify website identities

What Are Digital Certificate Keys? eMudhra operates as a Certificate Authority, issuing digital certificates that help browsers verify website identities and secure connections. Cryptographic keys are essential to this process. The affected keys were intended to be 115 digits long. However, some were extremely short, including one containing only the number four.

According to Business Today's report, a custom Python script used during key generation contained a software bug

A Python Script Error is Blamed: According to Business Today's report, a custom Python script used during key generation contained a software bug. The script was intended to transfer cryptographic keys between two Hardware Security Modules. The error reportedly reduced the size of eight keys, resulting in dangerously weak cryptographic values being generated.

The eight affected keys were identified as 4, 56, 66, 115, 155, 156, 230 and 237

Eight Weak Keys were Identified: The eight affected keys were identified as 4, 56, 66, 115, 155, 156, 230 and 237. Their short lengths made them potentially vulnerable to guessing or brute-force attacks. Such weaknesses could allow attackers to misuse digital certificates and potentially create fraudulent certificates impersonating legitimate websites.

The report said the Python script also created copies of the keys in an ordinary computer's memory

Keys May Have Left Secure Hardware: The report said the Python script also created copies of the keys in an ordinary computer's memory. This raised concerns that sensitive cryptographic material could exist outside protected hardware. eMudhra subsequently revoked all 16 certificates associated with the affected keys as a precautionary security measure.

Google, Mozilla, Apple and Microsoft released security updates following the incident to prevent potential exploitation

Technology Companies Responded: Google, Mozilla, Apple and Microsoft released security updates following the incident to prevent potential exploitation of affected certificates. eMudhra also changed its key-generation approach, avoiding transfers between Hardware Security Modules. The company announced its exit from the digital certificate business and promised an expert review.

There is an important distinction between the reported explanation

What Did eMudhra Say About the Incident? There is an important distinction between the reported explanation and the company's public statement. eMudhra confirmed weak keys and their revocation but said its exact root cause remained under investigation. It also said no certificates had been issued from affected intermediates and no data breach was identified.

Cybersecurity

Related Stories

Fliki
Midcap Stocks Crash 5.6% as Swiggy, KEI Industries Lead Market Sell-Off
indian-firm-emudhra-exits-global-digital-certificates-business-after-2026.
How to Convert a Python Script Into an AI Agent