Researchers discovered that private keys linked to eight intermediate certificate authorities issued by India-based eMudhra were generated with weak randomness, allowing their reconstruction. Major browsers promptly blocked these certificates, raising concerns over internet security and trust mechanisms in India's digital ecosystem.
- Major browsers block 8 weak eMudhra intermediate certificates
- Vulnerability traced to insufficient randomness in key generation
- Incident raises questions on India’s certificate authority oversight
What happened
In October 2026, a security researcher named Wayne exposed that eight intermediate certificate authorities (CAs) issued by Indian company eMudhra had private keys generated with insufficient randomness. This flaw made the private keys recoverable from public certificates, posing a risk that fraudulent certificates could be issued using those keys. The researcher demonstrated control by signing a test message with them. Android, Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft browsers and root programs quickly responded by blocking the affected certificates and initiating revocation and mitigation processes.
eMudhra confirmed the issue originated from a key generation ceremony in April 2025. Although only one intermediate CA was active in production and none had yet issued website certificates, all eight were revoked. The affected intermediates included those used for website security (TLS) and software signing. eMudhra’s core Indian digital signature services and eSign business operate on separate infrastructure, reportedly unaffected by this incident.
Why it matters
Digital certificates issued by CAs form a fundamental trust chain that enables secure internet communications by assuring users that websites are authentic. The compromise of intermediate CA private keys represents a significant vulnerability since anyone controlling such keys could issue fraudulent certificates, potentially enabling man-in-the-middle attacks or impersonation of legitimate websites and software.
This incident underscores the challenges of maintaining robust security standards in certificate issuance, especially for Indian players integrated into the global browser trust stores. It also spotlights the critical role of regulatory oversight within India’s certificate authority ecosystem and the need for stringent audits and cryptographic controls. The swift market reaction—eMudhra shares fell 20%—reflects investor concerns about reputational damage and future business impact.
What to watch next
Stakeholders will focus on how eMudhra and India’s Controller of Certifying Authorities (CCA) respond to strengthen governance, security audits, and operational protocols to prevent recurrence. Attention will also be on efforts to replace the withdrawn intermediate certificates without disrupting customers and impacted systems relying on eMudhra-issued credentials.
Broader industry and regulatory reactions across India and internationally may follow as observers assess if further weaknesses exist in digital trust chains involving Indian CAs. The incident will likely prompt other certificate authorities in the region to proactively review their cryptographic standards and key management practices. Market sentiment and customer confidence in eMudhra’s global TLS business, which forms about 1% of its revenue, will also be closely monitored.