Indian certificate authority eMudhra admits weak keys were published, as customers face costly certificate replacement

Indian certification authority eMudhra has responded to reports that private keys used to sign some of its digital certificates were extremely weak. According to The Register, one key was simply the number 4, and several others were short, easily guessed numbers. Keys like these can be worked out by outsiders, which would make it possible to forge certificates and impersonate websites or other online resources.

eMudhra says the keys were generated at a ceremony on 30 April 2025 using hardware security modules, which are standard equipment for this job. It claims a flaw caused a step in the process to produce a second set of weak keys alongside the original strong ones, and that the weak set was the one published to browser root stores. The company says it is still working to establish the root cause. It also points out that its roots and issuing authorities passed independent audits two years running and have been in browser trust lists since mid-2025, which appears to shift some blame to others. It adds that its TLS business is only one percent of revenue.

That financial detail does little for customers. Anyone relying on the affected certificates now has an urgent and unwanted job replacing them. eMudhra says it is working directly with potentially affected customers to supply replacements so services are not disrupted, and is working with the browser root programs. It concedes the incident may carry reputational risks that cannot be quantified.