Digital identity and online security provider eMudhra has tendered an apology following a significant technical vulnerability that left cryptographic private keys for eight intermediate certificate authorities dangerously vulnerable to recovery. The flaw, caused by a software scripting error, reduced the complexity of the keys to the point where they were exceptionally easy to guess. The vulnerability created serious security concerns that malicious actors could potentially generate fraudulent certificates to impersonate legitimate websites, though the company stated it revoked the affected certificate authorities within 14 hours of confirming the issue and detected no customer data compromises.
Flawed scripting uncovered by independent security research
The critical lapse surfaced on October 17 after an independent security researcher identified as Wayne demonstrated that private keys tied to eight intermediate authorities generated by eMudhra could be reconstructed. Findings revealed that the keys possessed an effective key space of merely three to eight bits, rendering them mathematically trivial to compute. Intermediate certificate authorities serve as indispensable trust links between root authorities and end-entity web domains, meaning compromised signing keys could permit attackers to forge credentials that web browsers would automatically trust.
Ben Cartwright-Cox, director of BGP.tools, described the vulnerability as highly unusual, suggesting that testing code might have inadvertently made its way into active operational environments. To demonstrate the severity of the flaw, the researcher launched a dedicated website illustrating how the weakened keys functioned. Following the confirmation, eMudhra acknowledged the scripting mistake as entirely its own responsibility, explaining that the eight vulnerable intermediate authorities had originally been generated in April 2025 during an infrastructure rollout.
Browser vendors take defensive action as certificates are blocked
Major web technology firms intervened rapidly to protect global users from potential exploitation. By October 20, Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft Edge had pushed updates to block trust in the eight affected authorities. Web infrastructure provider Cloudflare confirmed the risk on October 19, stating that while it detected no active exploitation across its customer network, it had issued protective updates for its WARP client, 1.1.1.1 resolver service, and cloudflared tunneling software.
In its public communication on October 26, eMudhra stated that its internal review found no evidence that the compromised authorities had ever issued publicly trusted web certificates before their revocation. The company further noted that its primary digital signature operations, eSign services, and enterprise software platforms run on segregated network infrastructure and remained completely unaffected. The root certificate authority and other unrelated intermediate signing keys were likewise confirmed to be secure.
Investigation report planned alongside independent audit
The company announced plans to publish a complete incident report through the Common CA Database framework and engage an independent cybersecurity auditor to examine its development processes and internal safeguards. Impacted clients using its Transport Layer Security services will receive replacement certificates free of charge. Management stated that extensive reviews are underway to understand why pre-existing deployment checks failed to catch the weak key generation scripts.
The breach has directed attention toward procedural standards across certificate-issuing bodies, where rigorous peer review and cryptographic validation form the bedrock of encrypted web communication. While verified instances of malicious impersonation have not been identified, the presence of vulnerable authority keys on production systems exposed systemic risks across public internet infrastructure. Further technical documentation and policy overhauls are scheduled to be implemented in the coming weeks to prevent similar software implementation failures.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
