Developing story
eMudhra Compromised TLS Certificates and Weak Private Keys
eMudhra Compromised TLS Certificates and Weak Private Keys: 2 developments over 2 days, since 20 October 2026. Latest, 22 October 2026: Indian digital trust services provider eMudhra said on Thursday it will voluntarily withdraw from the global SSL/TLS certificate business after its digital certificates were found to have vulnerabilities.
The story so far
Security teams worldwide were on high alert on Tuesday 20 October after eight intermediate TLS certificates issued by India-based certificate authority eMudhra Limited were found to have private keys so weak that anyone could use them to create trusted credentials for any website 1. The flaw was described as extreme 1.
On 22 October, eMudhra publicly defended itself after it emerged that the private keys used to sign some of its digital certificates were extremely weak 2. One key was reportedly just the number 4, and others were short, easily guessed two- or three-digit numbers 2. Critics called the practices laughably weak 2.
Later that day, eMudhra said it would voluntarily withdraw from the global SSL/TLS certificate business 3. The company said weak private keys had been found behind eight of its intermediate certificate authorities 3. The keys were described as being between 3 and 8 bits long 3. The fallout was fast 3.
Written automatically from the Oesnada stories in this timeline. Every number is checked against them. The numbers in brackets link to those stories.
Timeline
- MajorReuters
eMudhra to Exit SSL/TLS Certificate Business After Weak 3- to 8-Bit Keys
Indian digital trust services provider eMudhra said on Thursday it will voluntarily withdraw from the global SSL/TLS certificate business after its digital certificates were found to have vulnerabilities.
Also on our radareMudhra Defends Private Key Practices After Critics Call Them Laughably WeakThe Register
Indian certification authority eMudhra has publicly defended itself after it emerged that private keys used to sign some of its digital certificates were extremely weak. One was reportedly just the number "4," and others were short, easily guessed two- or three-digit numbers. In a statement, the company said the keys were created during a Key Generation Ceremony on April 30, 2025, using FIPS 140-2 Level 3 hardware security modules, the tamper-resistant devices normally used to generate and store keys securely. The weakness matters because keys that are easy to deduce make it possible to forge certificates and impersonate websites or other online resources, which is useful to scammers and phishers. The security industry has called for faster adoption of better certificates and noted that replacing the affected ones will be a long, burdensome job. For organizations relying on eMudhra, that means an urgent and potentially costly replacement task, whatever the effect on the company's own finances. eMudhra says a flaw in the ceremony caused a wrap/unwrap step, which protects keys during transfer, to produce a second set of weak keys alongside the original strong ones, and that the weak set was the one published to browser root stores. It says it is still working to establish the root cause. The company noted that its roots and issuing certificate authorities passed independent audits for two consecutive years and have been in browser trust lists since mid-2025, and that its TLS certificate business accounts for about one percent of revenue. It says it is working directly with potentially affected customers to provide replacement certificates, and with browser root programs, while acknowledging reputational risks it cannot quantify.
Read at the source- Ars Technica
Internet on High Alert After Discovery of 8 Compromised TLS Certificates
Security teams worldwide were on high alert Tuesday after eight intermediate TLS certificates, issued by India-based certificate authority eMudhra Limited, were found to have private keys so weak that anyone could use them to create trusted credentials for any website.
Topics in this story
Methodology and sources
Oesnada groups published stories into a developing story when a language model judges that they continue the same thread. The grouping is automatic and can be wrong. A thread gets a page once it has at least 3 developments spread over at least 2 different days. The one-line updates and the summary are written automatically from Oesnada stories only, and every number in them is checked against those stories.
Cite this page
Oesnada, "eMudhra Compromised TLS Certificates and Weak Private Keys", https://oesnada.com/storylines/emudhra-compromised-tls-certificates-and-private-key-practices, accessed 23 October 2026.