eMudhra quits website certificates after weak keys surface; Microsoft and browsers block its certificates

A certificate authority's private key is meant to be a number around 115 digits long. Eight of the keys behind eMudhra's certificates were numbers below 256, and one was simply 4.¹ That finding, made by a researcher on 17 October 2026, has led the Bengaluru company to leave the global website certificate business and appoint KPMG to review what happened.¹

How a key of 4 got through

eMudhra says an error in a software script used during a key generation ceremony on 30 April 2025 produced the weak keys, and that staff "used the weak keys by mistake".¹ Anyone holding one of those keys could have issued certificates that browsers would trust for any website.¹²

PCWorld spells out the risk: anyone could recreate keys that weak, which would let attackers forge certificates and pose as real websites or apps.² Neither source reports any attack that used them.¹²

BDO, which audits eMudhra's global business, did not catch the problem, ThePrint reports.¹

What browser and Windows makers did

Mozilla, Google, Apple and Microsoft have all blocked the compromised certificates.¹ Microsoft went further. It had blocked the affected certificates on 20 October, then shipped a Windows update on 26 October that removed seven eMudhra-linked certificates higher up the chain from its trusted list, with Edge following on 27 October.¹²

Google and Microsoft are still reviewing eMudhra's remaining root certificates.¹ Mozilla sent questions on 20 October with a 24-hour deadline; eMudhra asked for more time.¹

eMudhra's response

On 22 October, eMudhra said it would exit its global website certificate business, which it says brings in about 1% of revenue.¹ On 30 October it told the stock exchanges it had appointed KPMG for an independent review, without saying what the review covers, when it will finish or whether the findings will be public.¹ It has promised a root-cause report but has not given a date.¹

A second, smaller issue surfaced on 25 October, when eMudhra's servers rejected requests for certificate revocation lists. The company blamed a firewall setting in place since September 2022 and removed it the next day.¹

The IT ministry has set up a team to investigate and says eMudhra's domestic digital signature and eSign services are unaffected.¹

Why Indian banks are watching

Indian banks use at least seven of eMudhra's remaining root certificates for their websites, according to a scan by the consumer platform CashlessConsumer, cited by ThePrint.¹ If browser makers distrust those roots too, the banks would need new certificates from another provider.

For most people, nothing needs doing. Keep Windows and your browser updating automatically; PCWorld says that covers it, though PCs that are offline or have certificate updates switched off may need a manual fix.²

For IT teams at Indian companies, it is worth checking which certificate authority issued your website certificates today, and having a backup provider in mind. Swapping certificates in a hurry is the kind of job nobody enjoys at 2 am.

What to watch

• eMudhra's root-cause report and the scope of the KPMG review.
• Google's and Microsoft's decisions on eMudhra's remaining roots, which affect bank websites.

Related: the PHP2Shell flaws and how AI helped find them and one hacker's use of AI agents against 100+ websites.