eMudhra apologised after a scripting error left eight digital certificate authorities vulnerable to recovery. The company revoked these certificates within 14 hours of confirming the issue on October 26. "The flaw was ours," eMudhra said. They found no evidence that customer data got compromised during this security incident in October.
A scripting error made private keys linked to eight eMudhra certificate authorities easy to guess. The company says it revoked the affected certificates and found no evidence of customer data being compromised.
Digital trust company eMudhra has apologised after a software scripting error left the private keys of eight intermediate digital certificate authorities vulnerable to recovery, potentially allowing attackers to create fake website certificates.
In an apology published on October 26, the company said it revoked the affected certificate authorities within 14 hours of confirming the problem. Its investigation has found no evidence that the affected authorities issued publicly trusted certificates to websites or that its systems or customer data were compromised.
"The flaw was ours," eMudhra said, apologising to customers, partners and the wider internet security community.
The company said its digital-signature and eSign services in India and overseas, along with its enterprise applications, use separate infrastructure and were not affected.
eMudhra will replace certificates for affected customers and other customers using its TLS services at no additional cost. It also plans to publish a detailed investigation through the Common CA Database (CCADB) process and appoint an independent expert to review the incident and its security controls.
How the security flaw came to light
The issue surfaced on October 17, when a security researcher known as Wayne reported that the private keys linked to eight intermediate certificates issued by eMudhra could be recovered. The keys reportedly had an effective key space of just three to eight bits, making them extremely easy to guess.
Digital certificates help browsers verify that a website is genuine and that a secure connection is being established with the right server. Intermediate certificate authorities act as links between trusted root authorities and the certificates issued to websites.
If an attacker obtains an intermediate authority's private key, they could potentially issue fraudulent certificates and impersonate legitimate websites, depending on the authority's permissions and the trust placed in its certificates.
Wayne demonstrated the vulnerability through a website set up at emudhra.we-have-a-problem.com. Ben Cartwright-Cox, director of BGP.tools, called the issue "bonkers" and suggested that sample code may have accidentally made its way into production systems.
Google Chrome, Mozilla Firefox, Apple Safari and Microsoft Edge moved to block the affected certificates by October 20.
Cloudflare confirmed the risk at around 17:00 UTC on October 19. It said it had found no evidence of active exploitation on its services and released updates to its WARP and 1.1.1.1 applications, as well as cloudflared, its tunnelling software.
In its account of the incident, eMudhra said the problem involved eight intermediate certificate authorities created during a key-generation exercise in April 2025 as part of its publicly trusted certificate infrastructure.
The company said its root certificate authority private keys and other intermediate authorities were unaffected. After learning of the issue, it began responding to the incident, revoked the affected certificates and worked with browser developers and organisations that manage trusted certificate lists to limit the risk to internet users.
eMudhra said its forthcoming investigation would explain how the error occurred, why its existing security checks failed to catch it and what steps it would take to prevent a repeat.
The company added that it would take further measures in the coming weeks to restore and maintain confidence in its services and the wider digital-trust ecosystem.