eMudhra flaw could have broken the internet, CBSE teen hacker Nisarga calls it an absolute disaster

eMudhra is going viral, but for the wrong reasons. Digital certificate keys issued by the Indian cybersecurity firm were apparently so weak, it got the whole internet concerned and talking. eMudhra eventually exited the TLS certificate business but concerns remain.

eMudhra incident could have broken the internet, that is what Nisarga Adhikary had to say about the latest cybersecurity fiasco going viral on the internet. In an exclusive interview with India Today Tech, the teen hacker who first found flaws in the CBSE website, called the incident an "absolute disaster" that could have been avoided.

Luckily, as Nisarga points out, tech companies were able to step up to avert any major crisis. "It's good that major companies like Google, Apple and Firefox have taken steps to mitigate and control the damage," he says.

For those unaware, eMudhra was in the business of issuing digital certificates that would give websites and web applications the padlock sign of approval proving their legitimacy. Soon after the news of eMudhra issuing vulnerable digital keys broke out, the firm exited the TLS certificate business, citing social media trolling as one of the reasons behind the move.

What went wrong?

A set of certificates rolled out by eMudhra had shockingly weak keys. These keys are supposed to be generated randomly with 384 bits, or numbers about 116 digits long. But in the case of eMudhra digital certificates at the centre of the controversy, these were small and shockingly simple to guess and crack, were 4, 56, 66, 115, 155, 156, 230, and 237.

So, in theory, a hacker could create a fake bank website, for instance, use one of these keys to get a certificate and then gain the padlock symbol.

The situation was controlled before any harm was done. The researcher who spotted the flaw, Wayne, informed Google, Apple, Microsoft, and Mozilla about the keys. And within hours, the companies had blocked the affected certificates from their browsers. eMudhra has clarified that none of these keys were actually used to issue any website certificates. India's cybersecurity agency, CERT-In, also issued an advisory, urging users to update their browser and operating systems to the latest version.

Experts remain concerned

Coming back to Nisarga's comments, he claimed that the incident could've been avoided. Akshay Garkel, partner at Grant Thornton Bharat, concurs. Garkel points out that a firm like eMudhra should've identified this flaw when it happened. "The risk should have been caught through rigorous cryptographic testing, secure key generation and independent security validation," he tells India Today Tech. "Critical security controls must be tested for effectiveness, not merely checked for compliance."

However, that was not the case. The keys were generated in April 2025, and since then, they were in eMudhra's systems, completely unnoticed. Govind Rammurthy, CEO of eScan, says that the flaw would've given any hacker a chance to set up fraudulent websites that looked genuine. "One of them was literally the number 4," he tells India Today Tech. "Anyone could calculate these keys from public certificate data in milliseconds and use them to issue fake but trusted certificates for any website, including banks, email providers or government portals."

Rammurthy adds that the situation also raises concerns over eMudhra's operations. "A simple post-ceremony check would have caught it immediately," he says. "It also means this went through audits undetected for eighteen months, which raises serious questions about the audit process as well as about eMudhra."

As we mentioned earlier, eMudhra says none of the keys were actually misused by hackers. Akshit Kaushik Devgun, co-founder of Mitigata, believes that there has been one casualty - trust. "The bigger concern is that this affects a fundamental layer of digital trust," he tells India Today Tech. "Even if there is no confirmed evidence of customer data being stolen, a failure at this level can create opportunities for impersonation and interception of online communications."

Going forward, Akshit notes, organisations need to take precautionary steps, but all eyes will be on eMudhra. He says that the company must not find itself in a similar situation again. "The longer-term priority is to establish why the key-generation controls failed and ensure the same weakness cannot recur," Akshit Kaushik Devgun explains. "Critical security controls must be validated, not merely assumed to be working."

But what does it mean for you?

Browsers that you likely use, such as Google Chrome, or Apple's Safari, have already blocked the certificates. So, if you update your browser and your device's operating system, you are likely to be unaffected.

Yet concerns are still there. Govind Rammurthy emphasises that the problem is not just limited to browsers. "The bigger exposure is in software that keeps its own list of trusted certificates, such as payment terminals, older Android phones, banking apps and enterprise systems," he adds. "Those protections depend on vendors' shipping updates, and the window between April 2025 and October 2026 can't be fully accounted for."

While it seems that the internet has managed to survive through this incident with not much of an impact, it has made some question how secure websites really are. As Akshit Kaushik Devgun puts it, "It is a reminder that the padlock symbol alone cannot guarantee safety if the underlying certificate infrastructure has been compromised."