eMudhra's Exit and the Gaps in India's Oversight of Digital Trust
The Exit and Why It Matters
An Indian company used secret keys to prove that websites around the world were safe. One of those keys turned out to be the number 4, a number any child could guess. On 17 October, a researcher told the world’s biggest browser makers. Within hours, they stopped trusting the company. On 22 October, the board of Bengaluru-based eMudhra decided to leave the global SSL/TLS certificate business completely.
This matters beyond one company. The padlock next to a web address is only as strong as the weakest company that browsers trust. eMudhra has been licensed by India’s Controller of Certifying Authorities since 2008. It holds about 38% of India’s digital signature market by value. It issues the certificates Indians use to file tax returns and company records. Its technology also supports sites such as UIDAI, India Post and the income tax portal. When a firm like this fails at the most basic step, the question is no longer only about one company’s skill. It is about how India watches over the people who hold the keys to its digital trust.
Leaving the business was the right decision for the company. But it is a sign of failure, not of responsibility. The government’s response so far shows a gap in oversight that is more worrying than the flaw itself.
Failure of Basic Practice
A private key should be a long random number, more than a hundred digits long. All eight of the affected keys were whole numbers below 256. Security researcher Scott Helme recovered every one of them on an ordinary laptop in under a second. In effect, the keys had been public since the day they were created in April 2025. For about eighteen months, anyone who looked carefully could have issued fake certificates for any website.
The company says that during a key-generation ceremony on 30 April 2025, a faulty script created a second, weak set of keys alongside the strong ones. The staff chose the weak set by mistake because the labels looked alike. A key ceremony is meant to be the most carefully watched moment in a certificate authority’s work. A mix-up of this kind shows that checks were missing or ignored.
There was even an early warning. In May 2025, records signed with these keys failed their checks. eMudhra later admitted it had simply re-signed them with the same flawed keys. Google said this raised serious concerns about the company’s transparency. The flaw also passed two independent audits, according to eMudhra itself. The paperwork said everything was fine while the most basic thing was broken.
The Response of Browser Root Programmes and the Question of Control
Google, Mozilla, Apple and Microsoft acted fast, and they were right to do so. Google says Chrome users were protected at once, without even restarting the browser. It then removed the eMudhra root that had signed the weak certificates. A company must keep proving its skill and care to stay on Chrome’s trusted list. This also cut off about 30,000 honest certificates. When no one can be sure how a company’s keys may have been used, the safest step is to stop trusting them.
The deeper lesson for India is about who holds the power. None of these decisions was taken in New Delhi. A few foreign browser makers decided within hours whether an Indian firm’s certificates would work on billions of devices. India has been here before. In 2014, after the government’s National Informatics Centre wrongly issued certificates for Google domains, Google limited the root of India’s certifying authority to a few Indian domains such as gov.in and nic.in. Twelve years later, the lesson that global trust is earned through strict and open practice, not granted by a licence, has still not been fully learnt.
A Gap in India’s Regulatory Oversight
The most revealing remark in this affair came from the government. Officials of the Ministry of Electronics and Information Technology told ThePrint that eMudhra works in two areas: digital signatures and eSign, which the Controller of Certifying Authorities regulates, and browser-trusted certificates, which follow a global framework checked by private auditors. The ministry, they said, is not involved in auditing the second.
This is accurate on paper, but in practice it is a confession. The same licensed company, with the same people and culture, ran a far more sensitive global operation that no Indian authority examined. If one wing could pick the wrong keys and then re-sign failing records with them, the public is entitled to ask whether the wing that signs tax filings is any safer.
The Internet Freedom Foundation has written to eMudhra, CERT-In and the ministry. It asked for a dated incident report, an audit by an auditor the company has not used before, and confirmation that the incident was reported within the six hours required by CERT-In’s 2022 rules. It also noted that it could find no statement from the Controller of Certifying Authorities. CERT-In’s advisory of 21 October told organisations to update their systems. That was useful, but an advisory to the public is not an investigation of the company.
The Way Forward
The exit is right for eMudhra, but it is a sign of failure. The real weakness lies in India’s oversight. If the government treats the matter as closed because the company has left the business, the next weak key may sit in the system that signs our tax returns. Treated as a stepping stone, this episode can make India’s system stronger.
First, the Controller of Certifying Authorities should open its own inquiry into eMudhra’s key ceremonies, covering the Indian hierarchy as well, and publish the findings. Second, every licensed certifying authority should follow simple, checkable rules, such as scanning each new key for weakness and having a second, independent person verify every key that comes out of a ceremony. Third, any Indian-licensed authority that also runs a global business should share its foreign audit and incident reports with the Controller, so that the failures of one wing are studied for lessons in the other.
A country that wants world-class digital public infrastructure cannot afford to have one of its best-known certificate authorities remembered for a key that was the number 4.
Sources
eMudhra Limited, Press release to the National Stock Exchange, "eMudhra Statement on distrust of select Global TLS Intermediate and one Root CA", October 21, 2026. https://nsearchives.nseindia.com/corporate/EMUDHRA2008_21102026105726_Press_Release_21102026.pdf
Google Chrome and Android Security Teams, "Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates", October 20, 2026. https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/
Soumyarendra Barik, "Why eMudhra exited digital certificates biz", The Indian Express, October 23, 2026 (print edition).
Vrinda Tulsian, "MeitY sets up team to probe eMudhra certificate breach, says digital signature services unaffected", ThePrint, October 21, 2026. https://theprint.in/tech/meity-sets-up-team-to-probe-emudhra-certificate-breach-says-digital-signature-services-unaffected/3078125/
Swati Khandelwal, "eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable", The Hacker News, October 22, 2026. https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html
The South First, "Explained: What is the eMudhra digital certificate fiasco and how can you protect yourself", October 2026. https://thesouthfirst.com/beyond-south/explained-what-is-the-emudhra-digital-certificate-fiasco-and-how-can-you-protect-yourself/
Shraddha Goled, "eMudhra Weak Link Tests India's Chain Of Digital Trust", Inc42, October 21, 2026. https://inc42.com/features/emudhra-weak-link-tests-indias-chain-of-digital-trust/
Comments