What is eMudhra and why internet is having a meltdown over this Indian company right now?

Researchers have discovered that eight digital certificate keys issued by Indian cybersecurity company eMudhra were so shockingly weak that they could be cracked easily. Google, Apple and other tech giants have now blocked them. However, the internet is now having a meltdown over how this happened in the first place.

Indian cybersecurity company eMudhra is at the centre of a major internet security scare. The reason? Eight digital certificates it issued to websites and online services were found to have critically weak private keys. Researchers found that the keys were so weak they could recover them in less than a second. If exploited, the flaw could have allowed attackers to create fake security certificates for websites and impersonate legitimate servers.

Apple, Google, Microsoft and Mozilla have since moved to block the flawed certificates, while Cloudflare and other software providers have rolled out security fixes. So far, there is no evidence that anyone has exploited the weak keys to carry out an attack.

However, the incident has raised serious questions about how such a basic security flaw went undetected and how long it will take to fix the problem across the internet.

But what exactly is eMudhra, and why has this discovery triggered such a widespread response? To understand that let's first look at what the company does and why its digital certificates matter.

What is eMudhra and why does the internet trust it?

eMudhra is an Indian digital trust and cybersecurity company that issues digital certificates and provides services related to digital identity and authentication. In simple terms, it issues certificates that help your browser check whether a website is genuine before you connect to it.

Every time you visit a website, your browser needs to verify that it is connecting to the right server. So, these digital certificates act as identity cards for websites. They help your browser verify a website's identity and establish a secure connection.

So, who issues these certificates? One such company is eMudhra, one of India's major digital trust and cybersecurity firms. It acts as a Certificate Authority (CA), issuing digital certificates that help browsers verify whether websites are genuine.

A Certificate Authority can also issue intermediate certificates, which allow them to issue certificates for individual websites through another level of authority. Together, these certificates help browsers check whether a website is genuine and establish a secure, encrypted connection.

Together, these certificates help browsers verify a website's identity and establish a secure, encrypted connection.

What is the recent issue and why does it matter?

The eMudhra fiasco centres on eight intermediate certificates created on April 30, 2025, whose private keys turned out to be shockingly weak. The keys were supposed to use the P-384 elliptic curve, which should provide roughly 384 bits of randomness, or around 1 followed by 115 zeros, possible values.

Instead, the private keys were just single-byte numbers: 4, 56, 66, 115, 155, 156, 230 and 237. Since a single byte can represent only 256 possible values, researchers were able to recover all eight keys in less than a second.

Researchers warn that, if exploited, these keys could have allowed attackers to create fake security certificates for websites and impersonate legitimate services. For users, this could mean visiting what appears to be a genuine website, such as a bank or an online shopping platform, without realising they are connecting to a fake server.

An attacker could also use these fake certificates to intercept or tamper with data being exchanged between users and websites, potentially putting sensitive information at risk.

And the problem was not limited to one website. These certificates were part of the system that browsers and other software rely on to decide which websites to trust. That is why Apple, Google, Microsoft and Mozilla moved to block the affected certificates to prevent them from being misused.

What does eMudhra say about the security flaw?

The company has acknowledged the issue. In a statement, eMudhra said it was investigating the issue involving eight intermediate certificates created during a key-generation process in April 2025.

"eMudhra is actively investigating a security incident involving a specific set of intermediate CA certificates created as part of a Key Generation Ceremony (KGC) conducted in April 2025 within its public trust infrastructure," eMudhra said in its statement.

The company stressed that the problem was limited to these certificates and did not affect its root certificate authority's private keys or other intermediate certificates.

"The incident is limited to these specific intermediate CA certificates and does not affect eMudhra's root CA private keys or other intermediate CAs," the company said.

eMudhra also revealed that only one of the eight affected certificates had been deployed in production, and none had been used to issue certificates for individual websites.

The company said it had also taken steps to contain the affected certificates and is also working with browser developers and other operators to protect users. It added that its investigation is ongoing and that it would share further updates as more details emerged.

What happens next?

While eMudhra's investigation is ongoing, the immediate priority for browser makers and software providers is to ensure that the affected certificates can no longer be trusted. Apple, Google, Microsoft and Mozilla have moved to block them, while Cloudflare and other software providers have rolled out security fixes. However, removing trust in the affected certificates across different browsers, operating systems and applications could take time.

Cloudflare has also warned that some customers may need to update their own systems, including custom certificate trust stores and server configurations. This means that even after major browser makers have blocked the affected certificates, some systems may still need updates to ensure they no longer trust them.

What do regular internet users need to do?

For most internet users, the best step right now is to keep their browsers, operating systems and apps updated. Browser makers have already taken steps to block the affected certificates, so users should install available updates rather than try to change certificate settings themselves.

While there is currently no evidence that the weak keys have been exploited in an attack, keeping software up to date will help users ensure that the latest security fixes are in place and reduces the risk of running into known vulnerabilities.