India Probes eMudhra After Major Certificate Security Failure
What Happened
The Centre has set up a special team to investigate eMudhra after eight intermediate certificate private keys were generated with extremely weak cryptographic values. The affected certificates could potentially have allowed someone possessing the keys to issue fraudulent certificates and impersonate websites or services. Major platforms including Google Chrome, Mozilla Firefox, Apple and Microsoft have blocked the affected certificates. eMudhra said a flaw during its April 2025 key-generation process produced a second set of weak keys that were mistakenly used.
Key Takeaways
There is no evidence so far that the weak keys were actually misused. However, CERT-In warned that exploitation could potentially enable interception or alteration of communications, credential theft, disclosure of sensitive information and financial fraud. eMudhra says its Indian digital-signature and eSign businesses operate on separate infrastructure and were unaffected.