Bengaluru-based digital certificate provider eMudhra is facing global scrutiny after a cryptographic vulnerability exposed weaknesses in the private keys associated with eight of its certificates. The company’s co-founder, Kaushik Srinivasan, has attributed the incident to a software script error, describing it as an isolated case and saying the company has found no evidence of wider damage.
The incident prompted major browser developers, including Google and Mozilla, to block the affected certificates, raising concerns about the security of digital certificates used to establish trust between websites and users.
Script Error Led to Weak Cryptographic Keys
In an interview with India Today Tech, Srinivasan said the problem originated during a key-generation process conducted on April 30, 2025. The process involved creating eight issuing Certificate Authorities (CAs), but an error in the script used to generate their cryptographic keys resulted in predictable and easily recoverable private keys.
“As a certifying authority, we routinely do these things called key generation ceremonies,” Srinivasan said, explaining that the issue was limited to the eight issuing CAs created during that process.
Security researchers reportedly discovered that the private keys could be recovered within seconds, potentially allowing attackers to forge digital certificates that browsers might otherwise trust.
According to Mozilla’s incident report, the certificates were generated using the P-384 elliptic-curve cryptographic standard. However, their private keys contained values that were significantly smaller than expected, making them vulnerable despite the intended cryptographic strength.
Srinivasan acknowledged that the company’s internal controls failed to detect the problem, even though the certificates had undergone external audits.
“Our control and failure lapses happened. It was a script error. We should have checked,” he said.
Google and Mozilla Block Affected Certificates
The vulnerability remained undetected for approximately 18 months before security researchers raised concerns. Following the disclosure, browser developers moved to distrust the eight affected certificates.
Weak certificate private keys can undermine website authentication. If an attacker obtains a private key, they may be able to create fraudulent certificates and impersonate a legitimate website, potentially exposing users to phishing or other security risks.
However, the existence of a vulnerability does not by itself establish that attackers exploited it. Whether any fraudulent certificates were created or used remains a key question.
eMudhra Launches Internal Review
Srinivasan said eMudhra is conducting a comprehensive review of its earlier key-generation procedures to determine whether similar weaknesses exist elsewhere. The company is also considering an independent third-party assessment to validate its findings.
He said the company had assessed its remaining keys associated with its global trust business and had not identified similar risks in those keys.
According to Srinivasan, the incident did not involve an infrastructure attack, data breach or data leak. He described it as a process failure rather than an external cyberattack.
The company has pledged to provide further assurance to the security community through additional analysis and verification.
Government Says Impact Was Limited
The Union Ministry of Electronics and Information Technology (MeitY) has also responded to concerns surrounding the incident. The ministry said it had taken note of the reported vulnerability and formed a special team to investigate the matter.
MeitY stated that the impact on Indian websites and applications had been limited in scope and duration, while pushing back against what it described as fear-mongering on social media.
Given eMudhra’s role in issuing digital certificates used by websites and digital services, the incident has renewed attention on the importance of robust cryptographic controls, independent verification and timely disclosure of security vulnerabilities.
Although the company maintains that the problem was isolated and has found no evidence of wider damage, the ongoing review and independent verification will be important in establishing the full scope of the incident.