eMudhra Flaw Raised Major Internet Security Fears
A security mistake at the digital certificate company eMudhra has caused big concerns about the systems that help people know if a website is safe. The problem became very popular after experts found that some of the codes made by the company were very easy to break.
Nisarga Adhikary, the teenager known for discovering flaws in the CBSE website, described the episode as an “absolute disaster” that could have had much bigger consequences if it had not been identified in time.
“It’s good that major companies like Google, Apple and Firefox have taken steps to mitigate and control the damage,” he says.
eMudhra was involved in issuing certificates that allow websites and online services to show they are real. These certificates are very connected to the padlock symbol that browsers show. The padlock symbol helps users know that their connection is safe.
The controversy began when researchers discovered that some keys generated by eMudhra were far smaller and easier to guess than they should have been. The affected keys included numbers such as 4, 56, 66, 115, 155, 156, 230 and 237.
In theory, such predictable keys could have allowed an attacker to obtain a certificate and make a fraudulent website appear legitimate. A fake banking website, for example, could potentially have displayed the familiar padlock symbol.
However, the situation was contained before such an attack could take place. Researcher Wayne alerted Google, Apple, Microsoft and Mozilla, following which the companies moved quickly to block the affected certificates. eMudhra has maintained that none of the weak keys were used to issue website certificates. CERT-In also advised users to update their browsers and operating systems.
Experts question how the flaw went unnoticed
Cybersecurity experts say the bigger concern is how such a serious weakness remained undetected.
Akshay Garkel, partner at Grant Thornton Bharat, says the problem should have been identified much earlier. “The risk should have been caught through rigorous cryptographic testing, secure key generation and independent security validation,” he tells India Today Tech. “Critical security controls must be tested for effectiveness, not merely checked for compliance.”
The keys were reportedly generated in April 2025 and remained within eMudhra’s systems until the issue came to light.
Govind Rammurthy, CEO of eScan, says the potential consequences were significant. “One of them was literally the number 4,” he tells India Today Tech. “Anyone could calculate these keys from public certificate data in milliseconds and use them to issue fake but trusted certificates for any website, including banks, email providers or government portals.”
He also questioned the effectiveness of the company’s security checks. “A simple post-ceremony check would have caught it immediately,” he says. “It also means this went through audits undetected for eighteen months, which raises serious questions about the audit process as well as about eMudhra.”
For Akshit Kaushik Devgun, co-founder of Mitigata, the biggest casualty may be confidence in digital security. “The bigger concern is that this affects a fundamental layer of digital trust,” he tells India Today Tech. “Even if there is no confirmed evidence of customer data being stolen, a failure at this level can create opportunities for impersonation and interception of online communications.”
He says eMudhra must now ensure the same weakness does not happen again. “The longer-term priority is to establish why the key-generation controls failed and ensure the same weakness cannot recur,” Akshit Kaushik Devgun explains. “Critical security controls must be validated, not merely assumed to be working.
What does the eMudhra issue mean for users?
For most users, there is no immediate reason to panic. Major browsers, including Chrome and Safari, have already blocked the affected certificates. Keeping browsers and operating systems updated should help protect users.
However, Rammurthy warns that browser protections are only part of the picture. “The bigger exposure is in software that keeps its own list of trusted certificates, such as payment terminals, older Android phones, banking apps and enterprise systems,” he adds. “Those protections depend on vendors’ shipping updates, and the window between April 2025 and October 2026 can’t be fully accounted for.”
The incident may have been contained before it turned into a wider attack, but it has exposed an uncomfortable weakness in the infrastructure behind online trust.
As Devgun puts it, “It is a reminder that the padlock symbol alone cannot guarantee safety if the underlying certificate infrastructure has been compromised.”