Cybersecurity news / Certificate incident
Eight weak certificate-authority keys shook confidence in website security. Here is what went wrong, how eMudhra responded and why its shares fell sharply.
When you open a secure website, your browser relies on digital certificates to check that the site is genuine. That trust depends on one simple idea: some keys are public, and some must stay secret.
In the eMudhra security incident, weak private keys were published for a small set of certificate authorities. That created a risk that fake certificates could be created and trusted. No customer data breach was reported, but the incident still triggered a major market reaction.
Public key vs private key
Here is the simplest way to understand the incident. A public key can be shared openly. A private key must stay secret. They work together to help secure websites and verify digital signatures.
In simple terms: the public key can be shared, but the private key must stay secret. If a private key is weak or guessable, trust breaks down.
What went wrong in the eMudhra security incident?
A researcher found that private keys linked to eight eMudhra intermediate certificate authorities were dangerously weak. These are part of the trust chain that browsers use when deciding whether a website certificate should be accepted.
eMudhra said the problem began during a key-generation ceremony on April 30, 2025. A flaw in the process created weak keys alongside strong ones, and the weak keys were the ones later published to browser trust stores.
Some reporting highlighted that one private key had the value 4. That is shocking because private keys are supposed to be extremely hard to derive.
Important: eMudhra said its infrastructure was not compromised, no customer data was breached, and its Indian DSC and eSign businesses were unaffected. This was a certificate security incident, not a confirmed theft of customer records.
eMudhra security incident: Market impact
The market reaction was sharp. eMudhra said the affected global TLS business contributed only about 1% of its revenue, but the incident raised concerns about confidence in the company.
On October 21, eMudhra shares fell about 20%. By October 22, the decline was about 37% over two trading sessions, according to market reporting. The share-price fall shows the potential financial consequences of a loss of confidence, even when the affected service is a small part of revenue.
On October 22, eMudhra also announced plans to exit its global SSL/TLS certificate business. The company cited increasing costs, compliance requirements and reduced commercial prospects alongside the scrutiny following the incident. The security failure was one factor in a broader business decision.
Why it matters
The eMudhra security incident matters because certificate authorities sit quietly in the background of the internet. Most people never think about them. But they help browsers decide whether a website is real and whether a secure connection should be trusted.
If private keys in that trust chain are weak, attackers may be able to create fake certificates and impersonate legitimate websites, at least on systems that still trust the affected certificates.
This describes a possible risk, not proven misuse in the wild. Browser vendors moved quickly to block the affected certificate authorities, and eMudhra said the impacted authorities did not issue end-user certificates.
Simple takeaway: the encryption standard was not broken. The problem was that the keys protecting trust were generated incorrectly.
What changed
Following the eMudhra security incident, browser and platform teams moved quickly to contain the risk. That response mattered because modern trust problems can spread far beyond one company.
eMudhra generated the affected certificate-authority keys.
A researcher alerted browser trust programs. Google and Mozilla took emergency action to block the affected certificate authorities.
eMudhra revoked the affected certificates. Mozilla released trust-store and Firefox updates, and CERT-In issued an advisory.
eMudhra announced that it would exit its global SSL/TLS certificate business while continuing its other digital trust services.
Google planned removal of the related root certificate from the Chrome Root Store.
What businesses should do
Most users will be protected by browser updates. Businesses, however, should not assume everything fixes itself automatically. They should know which certificate authorities, tools, and trust stores their systems depend on.
Know who issues your certificates
Review the certificate authorities behind your websites, APIs, and customer-facing services.
Keep devices and servers current
Update browsers, operating systems, containers, and trust stores, especially on older or managed systems.
Replace affected certificate chains
If your services depend on the impacted eMudhra root, work with your provider to replace certificates and test connections.
Plan for third-party failures
Maintain an owner, inventory, and response plan for vendors your business relies on.
Security starts with visibility
How Osto helps startups stay ahead of security risks
The eMudhra incident is a reminder that risk can appear in places teams do not watch closely enough. Osto helps startups build a stronger cybersecurity foundation and get better visibility into the systems, applications, and risks they depend on.
From discovering vulnerabilities to tracking risks and improving security posture, Osto brings key cyber needs together in one place.
One platform that covers your startup’s entire cyber needs.
Explore Osto →Official advisory: CERT-In advisory on the eMudhra certificate incident.
