Indian Certification Authority eMudhra’s Private Keys Were Easily Guessable, Compromised

What Went Wrong at eMudhra

Indian certification authority eMudhra, which claims to have issued over 60 million digital certificates, is facing a major crisis. According to The Register↗ (opens in a new tab), researchers found that the private keys used to sign certificates were extremely weak, some were just small numbers like '4', '56', and '115'. These keys are supposed to be long, random numbers that are impossible to guess. Instead, they could be calculated in less than a second on a standard laptop.

Mozilla was alerted to the issue on October 17, 2026, and quickly moved to stop trusting certificates issued by eMudhra in its Firefox browser. Google and Apple also took steps to block these certificates in Chrome and Safari, respectively. eMudhra has revoked the affected certificates, but many are still in use across various services.

How Many Are Affected?

eMudhra has issued more than 60 million certificates. These are used by websites and services to prove their identity and encrypt traffic. With the private keys compromised, attackers could create fake certificates for any website, making it possible to intercept or manipulate secure web traffic. This is a serious risk for any organisation or individual relying on eMudhra certificates for secure communication.

What Have Researchers and Vendors Said?

Security researcher Scott Helme analysed eMudhra's certificates and found the private keys were so simple that he could recover them instantly from public information. Other researchers found similar results, with private keys like '66', '155', and '230'. This level of weakness is highly unusual and points to a complete failure in key generation practices.

Mozilla, Google, and Apple have all responded by updating their browsers to reject certificates from eMudhra. Open source projects have also issued updates to stop trusting these certificates. However, eMudhra has not responded to media inquiries about the incident or explained how such weak keys were generated.

What Should Organisations and Users Do?

If your organisation uses certificates issued by eMudhra, you should check your systems immediately. Replace any affected certificates with new ones from a trusted authority. Developers and administrators can use scripts and tools to scan for eMudhra certificates in their environments. End users should make sure their browsers are up to date, as browser makers have moved quickly to protect users from the risk.

What Happens Next?

The clean-up is ongoing. Many services may still be using compromised certificates, and it will take time to find and replace them all. The incident has raised serious questions about eMudhra's security practices and the oversight of certificate authorities in general. Regulators and browser vendors may review their processes to prevent similar failures in the future.

The Bigger Picture

Digital certificates are a foundation of online trust. When a certificate authority fails to protect its private keys, the security of millions of websites and users is put at risk. This incident highlights the importance of strong cryptographic practices and regular audits for all organisations involved in internet security.