eMudhra’s Weak Certificate Keys Spark Global Trust Crisis and Business Exit

On October 17 2026 a security researcher disclosed that the private keys of eight eMudhra intermediate certificate authorities (CAs) were weak enough to be recovered in seconds. The eight CAs—six for TLS certificates and two for code-signing—had been created on April 30 2025 with single-byte private keys (4, 56, 66, 115, 155, 156, 230, 237) instead of the required 384-bit random values. Within hours Google and Mozilla blocked the intermediates, Apple and Microsoft followed, and eMudhra revoked the certificates on October 18 2026. India’s Ministry of Electronics and Information Technology (MeitY) formed a special investigative team, and eMudhra’s board announced on October 22 2026 that it would exit its global SSL/TLS certificate business.

The Wire - IndiaThe Next Web (TNW)eMudhra breach: IT ministry says digital signature & eSign services unaffected, sets up probe team New Indian ExpresseMudhra digital certificates found with weak secret keys The Indian ExpresseMudhra to exit global website security certificate business after key-generation flaw How a single flaw in a key generation ceremony left Bengaluru-based eMudhra’s global TLS certificates vulnerable, and what it means for websites that rely on them eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable eMudhra co-founder blames script error for weak crypto keys, claims no damage done

Digital certificates act as identity cards for websites. A trusted root CA signs intermediate CAs, which issue end-entity certificates to sites or software. eMudhra, a Bengaluru-based firm licensed by the Controller of Certifying Authorities (CCA), runs two services: Indian-regulated Digital Signature Certificates (DSCs) and an international web-security business that supplies TLS and code-signing certificates trusted by major browsers.

Business Standard (India)New Indian ExpresseMudhra Exits Global Digital Certificate Business After Security Failure eMudhra Certificate leak explained: What it is and how it affects the Internet users? First PostANI NewsE-Signature Services Not Affected: Government On eMudhra Web Security Certificates Row What eMudhra security incident means for anyone who shops, banks or pays online eMudhra quits global SSL business after security lapse triggers trust crisis eMudhra breach: IT ministry says digital signature & eSign services unaffected, sets up probe team

• eMudhra (Oct 21 2026) said a flaw in its key-generation ceremony produced weak keys, that its infrastructure was not breached, and that it revoked the eight CAs within 14 hours.

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

• MeitY took “serious note” of the incident, formed a special team, and said DSC and eSign services remain unaffected.

eMudhra Security Lapse Raises Questions Over Audits, Cybersecurity Oversight

• CERT-In warned that recovered keys could enable attackers to forge certificates and issued mitigation guidance.

E-Signature Services Not Affected: Government On eMudhra Web Security Certificates Row

• Google updated Chrome to block the compromised keys and scheduled removal of the emSign ECC Root CA-G3 on Oct 27 2026.

What eMudhra security incident means for anyone who shops, banks or pays online

• Mozilla added the six TLS intermediates to its OneCRL blocklist on Oct 17 2026.

eMudhra and PHP not alone, last 24 hours have been absolute cybersecurity chaos for internet

• Cloudflare rolled out protections on Oct 19 2026 and reported no evidence of active exploitation.

From eMudhra to PHP: Breach spree hits tech infrastructure, AI emerges as threat multiplier

• eMudhra claimed none of the eight intermediates issued end-entity certificates, yet some sources reported that one TLS intermediate had been deployed in production.

The Next Web (TNW)

• Google said no TLS certificates chaining to six of the intermediates appeared in Certificate Transparency logs before the block, while CERT-In cautioned that attackers could still forge certificates for systems that do not check those logs.

E-Signature Services Not Affected: Government On eMudhra Web Security Certificates Row eMudhra Exits Global Digital Certificate Business After Security Failure First PostBusiness Standard (India)eMudhra quits global SSL business after security lapse triggers trust crisis The Indian ExpressThe Wire - IndiaeMudhra Certificate leak explained: What it is and how it affects the Internet users?

• The timeline for root-certificate removal varies: Chrome’s scheduled removal is set for Oct 27 2026, whereas earlier reports mentioned an imminent rollout without a specific date.

eMudhra security breach explained: What it is and means for smartphone, internet users

• Chrome will remove the emSign ECC Root CA-G3 from its trust store on Oct 27 2026.

eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

• MeitY’s special team will continue its investigation, with a full root-cause report expected from eMudhra after the audit.

The Next Web (TNW)

• eMudhra will replace affected customer certificates free of charge and maintain revocation services until all legacy certificates expire.

eMudhra to exit global website security certificate business after key-generation flaw

• Organizations using eMudhra-issued certificates must audit trust stores, update browsers and non-browser applications, and migrate to alternative CAs where necessary.

eMudhra security breach explained: What it is and means for smartphone, internet users