Indian cybersecurity company eMudhra has come under scrutiny after researchers discovered eight digital certificates with critically weak private keys, prompting Google, Apple, Microsoft and Mozilla to take protective action. The vulnerability raised concerns about website authentication and the security of encrypted internet connections.
How Was the Security Flaw Discovered?
Security researcher Wayne identified the problem on October 17 after finding that eight certificates issued by eMudhra contained private keys that could be recovered almost instantly.
The certificates used RSA keys with a length of just 16 bits, making them exceptionally weak compared with modern cryptographic standards. Researchers found that the keys could be recovered in less than a second, potentially allowing attackers to impersonate legitimate websites.
The discovery raised questions about how certificates containing such weak cryptographic keys had been issued.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
What Is eMudhra and What Does It Do?
eMudhra is an Indian digital trust and cybersecurity company that operates as a Certificate Authority (CA), issuing digital certificates used to verify website identities and support secure internet connections.
When users visit a website, their browsers examine its digital certificate to help establish whether they are communicating with the intended server. These certificates are an important part of the infrastructure supporting encrypted online communication.
A weakness in the certificate system can undermine that trust and expose users to website impersonation.
Why Were the Keys Considered Dangerous?
The affected certificates contained RSA keys so short that computers could recover their private components with minimal effort. Modern cryptographic systems generally require substantially stronger keys to prevent such attacks.
If exploited, the weakness could allow attackers to create fraudulent certificates and impersonate legitimate servers, potentially exposing users to intercepted communications or deceptive websites.
The incident also raised concerns about how such certificates passed through the issuance process without being rejected.
What Action Did Technology Companies Take?
Following the discovery, major technology companies moved to prevent the affected certificates from being trusted by their products.
Apple, Google, Microsoft and Mozilla took steps to block the compromised certificates across their respective systems. Cloudflare and other software providers also introduced security fixes to address the vulnerability.
The response was intended to prevent attackers from exploiting the weak certificates while browsers and related software incorporated the necessary protections.
Were Internet Users Actually Attacked?
Despite the severity of the vulnerability, there was no evidence at the time of reporting that attackers had exploited the weak keys to conduct malicious activity.
Security experts nevertheless warned that certificates with easily recoverable private keys could create opportunities for website impersonation and man-in-the-middle attacks.
Such attacks can allow criminals positioned between users and websites to interfere with communications, particularly when certificate verification mechanisms fail to identify fraudulent connections.
The discovery therefore prompted preventive action even without confirmed exploitation.
What Happens Next for Internet Security?
The incident has renewed attention on certificate issuance practices and the safeguards used to prevent weak cryptographic keys from entering trusted systems.
While major technology companies have already introduced protective measures, the broader concern is how a fundamental cryptographic weakness escaped detection and whether similar problems could remain elsewhere.
Browser updates and security patches are expected to play an important role in protecting users, although the time required for fixes to reach all systems may vary.
The420 Insight: What Should Users Do?
The eMudhra incident demonstrates how weak cryptographic controls can undermine trust in otherwise legitimate digital certificates. Although no exploitation has been confirmed, users should keep browsers, operating systems and security software updated, avoid bypassing certificate warnings and remain cautious when accessing sensitive websites. For certificate authorities, the case highlights the importance of rigorous key validation and security checks before certificates are issued.
About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
