Research noteResearched 2 Nov 2026 · published 2 Nov 2026, 21:39 IST

Research note: eMudhra quits website certificates after weak keys surface; Microsoft and browsers block its certificates

How we checked the eMudhra key lapse, the response from Microsoft and browsers, and what is still open.

Research led by Mayank Sahu

Compiled with AI assistance (Claude by Anthropic)

Read the story →

At a glance

1searches run

3sources read

2sources used

6facts labelled

Limitedevidence strength · 1 of 5 facts (20%)

How we rate evidence: Most facts rest on a single report or on the company’s own claims. We count the share of known facts labelled Confirmed or Reported: 70% or more is Strong, 40–69% Mixed, below 40% Limited.

From sources to story

How many sources we read, how many we used, and how many are official or archived.

Read3Every source we opened

Used2Relied on for the story

Cited2Linked in the story

Official0From the company or a public body

Archived2Saved on the Internet Archive

How sure we are, fact by fact

141

Reported · 1 — Two or more independent, named outlets say it.
Unconfirmed · 4 — One report only, shown with its source.
Not known · 1 — Not announced or not answered yet.

Evidence map

Each row is a fact from the story; each column is a source. A filled dot means that source supports the fact.

Fact	Label	1OUT	2OUT
Private keys behind eight eMudhra certificates were numbers below 256; one was 4.	Unconfirmed
Microsoft removed seven eMudhra-linked certificates from Windows on 26 October and from Edge on 27 October.	Reported
Mozilla, Google, Apple and Microsoft blocked the compromised certificates.	Unconfirmed
eMudhra will exit its global website certificate business and has appointed KPMG for a review.	Unconfirmed
MeitY says domestic digital signature and eSign services are unaffected.	Unconfirmed
Any misuse of the weak keys.	Not known

Question

What we set out to check

What went wrong with the keys, how Microsoft and browser makers responded, what eMudhra is doing and who is affected in India.

Findings

What we found

ThePrint gives the full timeline, eMudhra's explanation, the KPMG appointment and the bank scan. PCWorld confirms Microsoft's two-step response and explains the risk for ordinary users. Neither reports any attack using the keys.

Discrepancies

Numbers that differ

Both sources say Microsoft removed seven certificates in its Windows update. ThePrint calls them root certificates; PCWorld says they sit higher in the chain than the eight weak intermediates. These describe the same step.

Method

Labels we chose and why

Reported for Microsoft's update, which both outlets cover. Unconfirmed for eMudhra's explanation, the KPMG review and the bank scan, from ThePrint only.

Open questions

What we could not verify

eMudhra's stock exchange filings and the browser makers' own posts.

Can you help confirm one of these? Send us a source. When we find an answer, we update this note and the story, with the date.

Next steps

How we could improve this

Read eMudhra's filings and Mozilla's and Google's bug threads directly, and update when the root-cause report is out.

Research timeline

Research2 Nov 2026
Research note published2 Nov 2026, 21:39 IST
Story published2 Nov 2026, 21:49 IST

What we searched

eMudhra exits website certificate business Microsoft removes certificates

Every source we read

Source	Used?	Why
ThePrint Archived copy	USED	Timeline, cause, KPMG, MeitY, banks.
PCWorld Archived copy	USED	Microsoft's actions and advice for users.
BleepingComputer	NOT USED	Page did not load for us.

Sources cited in the story

Research notes show our working. They are not peer-reviewed papers. Data: facts as JSON · How we report