eMudhra cybersecurity fiasco: What it means for you and how to stay protected

Researchers recently uncovered a serious security flaw involving Indian cybersecurity company eMudhra. Google, Apple and other tech firms have also moved to block the affected certificates issued by the company. But should you worry? Here is what you need to do.

Fraudulent websites have existed on the internet since the time the internet was born. Over the course of time, guardrails have been built so people accessing the internet could do so safely. Digital certificates play a key role in this. You can think of them as an ID that proves the authenticity of a website. Certificates of course come in different shapes and sizes but broadly speaking there is an accepted standard of what makes a website legitimate.

Just as there are certificates, there are certificate providers. One of them -- eMudhra -- has now come under the scanner for putting out weak certificates that, if exploited, could bring serious harm to netizens given that eMudhra happens to be one the largest companies of its kind in India today. No wonder the internet is having a meltdown over the cybersecurity fiasco.

Researchers have found that eight digital certificates issued by eMudhra had private keys so weak anybody with basic technical know-how could exploit it. Created on April 30, 2025, the keys were supposed to contain 384 bits of randomness. Instead, they were just single-byte numbers: 4, 56, 66, 115, 155, 156, 230 and 237.

The flaw was so serious that Apple, Google and Mozilla along with other who's who of the internet like Cloudflare had to step in and block these certificates ASAP.

eMudhra meanwhile says that it is investigating the issue and that the problem is limited to the eight affected intermediate certificates. The company says its root certificate authority's private keys and other intermediate certificates remain unaffected. As things stand, there is no public evidence that the weakness has been exploited in an attack.

But should you be worried about your online safety? Well, there is no need to panic. However, there are a few simple steps you can take to stay safe online while browsing.

1. Update your browser and devices

First things first, make sure your browser, operating system and apps are up to date. Google, Apple and Mozilla have already taken steps to block the affected certificates issued by eMudhra, so installing the latest updates will help ensure your browser has the relevant security fixes.

Check for pending updates on your phone, laptop or desktop and install them as soon as they are available.

- On your phone, head to Settings and look for the software update option.

-On your computer, check for updates in your operating system settings.

For browsers such as Chrome and Firefox, open the browser settings and look for the About section to check whether an update is available.

2. Be careful before clicking on links

The concern with compromised certificate keys is that attackers could potentially use them to create fake security certificates and impersonate genuine websites.

That makes it worth taking extra care with links you receive through emails, text messages and messaging apps. Before entering a password or payment details, check the website address carefully. If a message claims to be from your bank or another service and urges you to log in immediately, do not click the link. Visit the official website directly instead.

3. Do not ignore certificate warnings

If your browser throws up a security warning while opening a website, do not dismiss it just to get to the page. Such warnings can point to a problem with the website's security certificate or the connection itself.

If your browser says the connection is not secure, avoid proceeding, particularly when accessing banking, shopping or other services that handle sensitive information. Never disable certificate checks to get around a warning.

Already turned off security protections? Turn them back on as soon as possible. In Google Chrome, click the three-dot menu in the top-right corner, go to Settings > Privacy and security > Security, and check your security options.

You can enable Always use secure connections to get warnings before visiting websites that do not use HTTPS. However, this is different from certificate verification, which should not be disabled in the first place. If you have changed advanced certificate settings or those of another application, follow the official support instructions to restore them.

4. Do not panic or change security settings yourself

The eMudhra incident is alarming, but there is currently no public evidence that the weak keys have been exploited in an attack. Browser makers, including Google, Apple and Mozilla, along with software providers such as Cloudflare, have already taken steps to block the affected certificates.

For most users, there is no need to change certificate settings manually, install unfamiliar security tools or delete certificates from their devices. Stick to official software updates and guidance from your browser or device manufacturer.

5. Keep an eye out for suspicious activity

As a general precaution, watch for unexpected login alerts, unfamiliar transactions or password-reset messages. If you spot anything unusual on a financial account, contact your bank through its official channels, rather than using a phone number or link sent to you in a message.

While these steps are sensible online safety habits in general, there is no need to assume your accounts have been compromised because of the eMudhra incident. But staying alert and keeping your software updated are the best habits to stay safe.