eMudhra Key Flaw Shakes Digital Trust

India's cybersecurity agency, CERT-In, has issued an advisory concerning compromised eMudhra intermediate certification authority certificates, exposing a serious weakness in the cryptographic infrastructure protecting websites, software and digital communications.

Key Highlights

1. Eight certificates affected: Weak private keys exposed critical certificate-authority trust mechanisms.

2. Potential impersonation: Attackers could theoretically forge trusted certificates and intercept communications.

3. Browser protections activated: Mozilla and Google introduced certificate-blocking and distrust measures.

4. Indian eSign unaffected: CERT-In confirmed eMudhra's domestic regulated services remained isolated from the incident.

The advisory, dated October 21, 2026, identifies eight affected intermediate certificates. Their private keys were generated using insufficient cryptographic randomness, making them vulnerable to rapid mathematical recovery.

Shockingly, the affected P-384 private keys contained values smaller than 256, despite relying on a sophisticated elliptic-curve cryptographic standard. CERT-In clarified that the failure originated during key generation, not within the underlying encryption algorithm.

According to eMudhra, an error during the key-generation ceremony produced weak secondary keys alongside legitimate strong keys. These weaker keys subsequently entered browser trust stores, creating potential opportunities for certificate forgery.

Attackers possessing these keys could theoretically impersonate legitimate websites, intercept encrypted communications or generate fraudulent code-signing certificates. Such exploitation could facilitate credential theft, financial fraud and malicious software distribution.

However, CERT-In reported no confirmed malicious exploitation as of October 21. eMudhra revoked eight intermediate certificates on October 18, while Mozilla and Google introduced blocking measures and announced additional browser trust-store protections.

Importantly, eMudhra stated that its Indian digital signature certificate and eSign services remain unaffected because they operate through separate infrastructure. The incident nevertheless reinforces the urgency of secure key generation, independent cryptographic verification, hardware security modules and continuous certificate monitoring.

The larger warning: Digital trust depends not merely on powerful encryption, but on how securely cryptographic keys are generated, validated and governed.