Story perspectives

Browsers Block eMudhra Certificates After Weak Single-Byte Keys

By Drooid · Oct 22, 2026, 4:11 AM UTC · How we work

Summary

eMudhra Weak Certificates

eMudhra disclosed eight CA certificates used weak single-byte private keys, prompting browser blocks.
Google, Apple, Microsoft and Mozilla blocked the certificates in Chrome, Safari, Edge, Firefox on Oct 20.
CERT-In warned the keys could enable fake certificates and man-in-the-middle attacks.
eMudhra’s shares fell about 20% to Rs 432 and it reported no breach.
The weak keys were single-byte numbers (4, 56, 66, 115, 155, 156, 230, 237) instead of 384-bit values.

Summary

MeitY Issues Warning

MeitY warned against fear-mongering on social media about the eMudhra incident.
MeitY clarified that only eMudhra’s international certificate business was affected, not its domestic DSC and eSign services.
eMudhra’s global certificate operations are audited under WebTrust standards by BDO International Limited.
CERT-In issued an advisory with mitigation measures for systems using the compromised certificates.

History

Historical Context

In 2011, the Dutch certificate authority DigiNotar was hacked, resulting in the fraudulent issuance of thousands of SSL certificates and a subsequent bankruptcy. The breach affected over 500,000 certificates, prompting Google, Mozilla, Microsoft and Apple to immediately distrust DigiNotar’s root and revoke trust across browsers. Today's eMudhra incident mirrors that episode, as weak single-byte keys risk man-in-the-middle attacks and have triggered blocks by Google, Apple, Microsoft and Mozilla. The DigiNotar fallout taught regulators to enforce stricter WebTrust audits, a lesson now guiding MeitY’s warnings and industry-wide remediation efforts.

1 of 3

eMudhra Weak Certificates

eMudhra disclosed eight CA certificates used weak single-byte private keys, prompting browser blocks.
Google, Apple, Microsoft and Mozilla blocked the certificates in Chrome, Safari, Edge, Firefox on Oct 20.
CERT-In warned the keys could enable fake certificates and man-in-the-middle attacks.
eMudhra’s shares fell about 20% to Rs 432 and it reported no breach.
The weak keys were single-byte numbers (4, 56, 66, 115, 155, 156, 230, 237) instead of 384-bit values.

1 / 3