eMudhra Weak Link Tests India’s Chain Of Digital Trust

A private key meant to vouch for the security of websites around the world turned out to be the number 4.

That was one of the weaknesses researchers found in eight intermediate certificate authority (CA) certificates issued by Bengaluru-based eMudhra. 

The discovery prompted Google, Mozilla, Apple, and Microsoft to block the affected certificates, triggering a wider effort to protect browsers, applications, and enterprise systems. The incident also rattled investors and eMudhra shares hit their 20% lower circuit at ₹431.55 on the BSE today. 

The immediate concern is whether software still trusting the compromised keys could accept fraudulent certificates. A related challenge is replacing legitimate certificates affected by browser makers’ decision to withdraw trust in a parent certificate.

A digital certificate acts as a digital identity that allows a browser to verify a website’s authenticity. Certificate authorities issue these certificates and vouch for their authenticity. eMudhra is among the certifying authorities licensed by India’s Controller of Certifying Authorities (CCA). 

The incident goes beyond one company. It shows how much of the internet’s security rests on a chain of trust that one weak link can undermine, raising questions about how India oversees companies that participate in this global infrastructure.

What Happened

On October 17, a researcher named Wayne notified the Chrome Root Program, which forwarded the report to Mozilla, and also contacted eMudhra and the Apple and Microsoft root programmes, reporting that he had obtained the private keys corresponding to eight eMudhra intermediate CA certificates. He demonstrated control of each key by signing a message with it “We have a problem here – Wayne”.

The full details of how the flaw was discovered and fixed have now been published by Dennis Jackson, a cryptographic engineer at Mozilla.

Intermediate CAs can issue certificates that websites use to establish their identity. Anyone holding the corresponding private keys could potentially issue fraudulent certificates for websites they did not control, allowing affected clients that still trusted those CAs to accept the certificates.

The keys were not stolen, but the researcher found that they had been generated with insufficient randomness, making them easy to reconstruct from the public certificates.

Six of the eight intermediates were intended for website security through TLS, while two were intended for software signing. Chrome, Apple, Microsoft, and Firefox blocked the affected TLS intermediates.

What eMudhra Says

In a statement on its website, eMudhra said it was investigating the incident and reviewing its security controls and operating procedures. The company said the eight intermediate CAs were created during a key generation ceremony on April 30, 2025, and the hierarchy entered browser trust lists in mid-2025. It said its roots and issuing CAs had undergone independent audits in each of the previous two years, but did not identify the auditors or disclose the scope of those audits.

eMudhra said only one of the eight affected intermediates had been deployed in production and that none had issued end-entity certificates. It said it revoked all eight intermediates and was working with affected customers and root programmes to address the incident.

The company also said the incident did not affect its Indian Digital Signature Certificate (DSC) and eSign businesses, which operate on infrastructure separate from its global TLS business. On October 21, eMudhra said the affected global TLS business accounted for around 1% of its revenue.

India faced a similar trust-related incident in 2014, following the misissuance of certificates for Google domains by the National Informatics Centre. At the time, Google restricted the India CCA root certificate in Chrome to a limited set of domains, including gov.in and nic.in.

eMudhra has been a licensed certifying authority under India’s IT Act since 2008. The company has also worked with public- and private-sector organisations, including banks and government agencies.

The company provides digital identity, authentication and security solutions to businesses, financial institutions and governments. Its services include digital signature certificates (DSCs), electronic signatures and tools that help organisations secure digital transactions and manage identities.

In India, its DSCs are used for activities such as filing documents with government portals, including GST, the Ministry of Corporate Affairs, and income tax systems. Its eSign services also support paperless digital workflows.

Many critical government websites, including the Aadhaar issuer UIDAI as well as websites of the Indian postal services and the income tax filing portal, use eMudhra certificates or other technology developed by the company.

Why It Matters Beyond eMudhra

Browsers and operating systems rely on lists of trusted certificate authorities. A compromised intermediate CA can therefore threaten trust beyond the authority’s direct customers.

With the compromised keys, an attacker could potentially issue fraudulent website certificates to impersonate legitimate sites and intercept traffic, provided the affected systems still trusted those certificates and the attacker’s other technical requirements were met. The two code-signing intermediates also raised concerns about malicious software being presented as coming from a trusted publisher on systems that accepted their signatures.

“When news like this comes out about a company that supports our PKI infrastructure, it raises concerns about both the company’s reputation and the country’s reputation. Even a relatively small mistake or a gap in the validation process can affect confidence in the wider industry. People may start to question whether PKI infrastructure provided by Indian companies can be trusted,” said Abhijeet Zilpelwar, cofounder and chief technology officer at pi-labs.

The Long Tail: Software And Devices

Updated browsers received protections quickly. The harder problem is software and devices that do not receive the same updates or reliably check certificate revocation.

Applications, programming languages, package managers and build pipelines can use their own certificate bundles or the operating system’s trust store. Some do not reliably check revocation status, meaning they may continue to accept certificates unless their trust configuration or software is updated.

Embedded devices can be harder to update. Routers, cameras, payment terminals and industrial controllers running old firmware may continue to trust affected certificate chains if their software does not receive the relevant protections.

For Indian enterprises, exposure does not depend solely on whether they bought certificates directly from eMudhra. The company says none of the eight affected intermediates issued certificates to end users, and Google found no certificates chaining to the six website-security intermediates in public Certificate Transparency logs before blocking them. 

However, systems that continue to trust the affected intermediates may remain exposed if they lack effective revocation checks or have not received relevant security updates.

Potentially affected systems include backend applications, servers and devices running outdated software, including those operated by organisations that use another certificate provider. Banking, fintech, e-governance and other businesses relying on certificate-based authentication should assess their exposure, though the incident does not establish that these sectors have been disproportionately affected.

“Mid-sized organisations, SaaS providers and those with lots of vendor-managed systems are most exposed as they often do not keep track of their certificates,” said Rajesh Chhabra, general manager for India and South Asia at global cybersecurity giant Acronis.

The Ministry of Electronics and IT has issued a statement saying that the impact of this incident on Indian websites and applications have been very limited and for a very short interval. Additionally, the department has also formed a special team to investigate the matter and is engaging with relevant stakeholders.

According to CERT-In’s advisory issued on October 21, organisations should update browsers, operating systems and applications, ensure servers and devices receive current trust lists and revocation information, identify affected certificates and services, and replace them where necessary. CERT-In also advised organisations to verify certificate details and not bypass certificate warnings or disable certificate checks.

Venkata Satish Guttula, former director of security at Rediff.com India, said the eMudhra incident raised wider concerns about security audits. “Titles keep getting bigger while the people holding them get more junior. Audits look clean on paper, but the skill behind them is thin,” he posted on X, describing what he called an “illusion of competence” in security audits.

The post eMudhra Weak Link Tests India’s Chain Of Digital Trust appeared first on Inc42 Media.