--- title: "eMudhra quits website certificates after weak keys surface; Microsoft and browsers block its certificates" url: https://anawords.com/story/emudhra-weak-certificate-keys-exits-website-certificates-kpmg-review published: 2026-11-02T21:49:47+05:30 updated: 2026-11-02T21:49:47+05:30 section: AI in India author: Mayank Sahu checked: sources checked by AI, approved by editor version: 1 --- # eMudhra quits website certificates after weak keys surface; Microsoft and browsers block its certificates One of the private keys behind eMudhra certificates was the number 4. The Bengaluru firm has appointed KPMG to review the lapse, and Indian banks using its other roots are watching. **In short:** eMudhra, a Bengaluru certificate authority, is leaving the global website certificate business after a researcher found on 17 October 2026 that private keys behind eight of its certificates were tiny numbers, one of them 4. Mozilla, Google, Apple and Microsoft have blocked the affected certificates, and eMudhra has appointed KPMG to review the lapse. A certificate authority's private key is meant to be a number around 115 digits long. Eight of the keys behind eMudhra's certificates were numbers below 256, and one was simply 4.[^1] That finding, made by a researcher on 17 October 2026, has led the Bengaluru company to leave the global website certificate business and appoint KPMG to review what happened.[^1] ## How a key of 4 got through eMudhra says an error in a software script used during a key generation ceremony on 30 April 2025 produced the weak keys, and that staff "used the weak keys by mistake".[^1] Anyone holding one of those keys could have issued certificates that browsers would trust for any website.[^1][^2] PCWorld spells out the risk: anyone could recreate keys that weak, which would let attackers forge certificates and pose as real websites or apps.[^2] Neither source reports any attack that used them.[^1][^2] BDO, which audits eMudhra's global business, did not catch the problem, ThePrint reports.[^1] ## What browser and Windows makers did Mozilla, Google, Apple and Microsoft have all blocked the compromised certificates.[^1] Microsoft went further. It had blocked the affected certificates on 20 October, then shipped a Windows update on 26 October that removed seven eMudhra-linked certificates higher up the chain from its trusted list, with Edge following on 27 October.[^1][^2] Google and Microsoft are still reviewing eMudhra's remaining root certificates.[^1] Mozilla sent questions on 20 October with a 24-hour deadline; eMudhra asked for more time.[^1] ## eMudhra's response On 22 October, eMudhra said it would exit its global website certificate business, which it says brings in about 1% of revenue.[^1] On 30 October it told the stock exchanges it had appointed KPMG for an independent review, without saying what the review covers, when it will finish or whether the findings will be public.[^1] It has promised a root-cause report but has not given a date.[^1] A second, smaller issue surfaced on 25 October, when eMudhra's servers rejected requests for certificate revocation lists. The company blamed a firewall setting in place since September 2022 and removed it the next day.[^1] The IT ministry has set up a team to investigate and says eMudhra's domestic digital signature and eSign services are unaffected.[^1] ## Why Indian banks are watching Indian banks use at least seven of eMudhra's remaining root certificates for their websites, according to a scan by the consumer platform CashlessConsumer, cited by ThePrint.[^1] If browser makers distrust those roots too, the banks would need new certificates from another provider. For most people, nothing needs doing. Keep Windows and your browser updating automatically; PCWorld says that covers it, though PCs that are offline or have certificate updates switched off may need a manual fix.[^2] For IT teams at Indian companies, it is worth checking which certificate authority issued your website certificates today, and having a backup provider in mind. Swapping certificates in a hurry is the kind of job nobody enjoys at 2 am. ## What to watch - eMudhra's root-cause report and the scope of the KPMG review. - Google's and Microsoft's decisions on eMudhra's remaining roots, which affect bank websites. Related: [the PHP2Shell flaws and how AI helped find them](/story/php2shell-critical-php-flaws-cve-2026-109618-patch-now) and [one hacker's use of AI agents against 100+ websites](/story/hacker-ai-agents-breached-100-company-websites-norforge). ## Fact ledger - [Unconfirmed] Private keys behind eight eMudhra certificates were numbers below 256; one was 4. (source 1) - [Reported] Microsoft removed seven eMudhra-linked certificates from Windows on 26 October and from Edge on 27 October. (source 1,2) - [Unconfirmed] Mozilla, Google, Apple and Microsoft blocked the compromised certificates. (source 1) - [Unconfirmed] eMudhra will exit its global website certificate business and has appointed KPMG for a review. (source 1) - [Unconfirmed] MeitY says domestic digital signature and eSign services are unaffected. (source 1) - [Not known] Any misuse of the weak keys. ## Sources 1. [ThePrint: eMudhra appoints KPMG to review compromised certificate keys](https://theprint.in/tech/emudhra-appoints-kpmg-to-review-compromised-certificate-keys-browser-makers-await-root-cause-report/3085892/) 2. [PCWorld: Microsoft pulls 7 eMudhra certificates from Windows. Here's what that means](https://www.pcworld.com/article/3270717/microsoft-pulls-7-emudhra-certificates-from-windows-heres-what-that-means.html)