A Bengaluru-based digital trust company has found itself at the centre of one of the most serious certificate authority incidents in recent memory, after it emerged that eight of its intermediate certificates were created with private keys so weak that anyone could recover them in under a second. The discovery has triggered a scramble across browsers, operating systems and software packages to block the affected certificates, and sent the listed company's shares tumbling.
The company is eMudhra, a licensed Certifying Authority in India listed on the National Stock Exchange and the Bombay Stock Exchange. The affected certificates -- six permitted to issue TLS certificates for websites and two meant for code signing -- belong to its global certificate business.
What makes the incident extraordinary is not that the keys were stolen, but that they never really needed to be: the private-key values were P-384 elliptic-curve numbers below 256, meaning an attacker would need to try no more than 255 guesses to recover each one. In cryptography, a P-384 private key is supposed to be an unpredictable 384-bit number with 2^384 possibilities; in this case, the keys were effectively single-byte values.
A Researcher's Message: "We Have a Problem Here"
The flaw was identified by an anonymous security researcher identified only as "Wayne", who reported the issue to the major root programmes on October 17. To prove he controlled the keys, Wayne signed a message reading "We have a problem here - Wayne" using each of the compromised keys. Security researcher Scott Helme later demonstrated just how trivial the flaw was: "I recovered all of them from their public certificates on my laptop just now, and it took less than a second."
Mozilla investigator Dennis Jackson independently recovered the keys that same evening without prior knowledge of Wayne's method, confirming the vulnerability was fully reproducible. According to Mozilla, the eight keys held single-byte values -- 4, 56, 66, 115, 155, 156, 230 and 237 -- rendering their encoded values nearly zero except for the final byte.
Instead of offering strong cryptographic protection, this limited candidate space allowed near-instant recovery through simple enumeration.
The compromised keys would have allowed anyone who recovered them to sign certificates that any client trusting eMudhra's G3 hierarchy would accept -- in theory enabling impersonation of almost any website. As of October 21, no malicious use of the keys had been confirmed, but the keys were recoverable for roughly seventeen months before the discovery.
How a Strong Key Became a Weak One
eMudhra's preliminary investigation found that the weakness traced back to its Key Generation Ceremony held on April 30, 2025, when the G3B and G3C intermediate certificates were created inside FIPS 140-2 Level 3 Hardware Security Modules. A modified key-generation script had added a wrap/unwrap test for keys intended for export.
While strong keys were initially created within the HSMs, the flawed code produced weaker alternatives -- and because the key labels were similar, staff selected the weaker keys when creating the certificate signing requests.
The company acknowledged multiple human errors and said its root-cause investigation is ongoing. It also noted that earlier invalid Certificate Revocation List (CRL) signatures were linked to this same mismatch: the revocation lists were initially signed using the original, strong keys and therefore failed verification against certificates carrying the weaker public keys. Those lists were later re-signed using the compromised keys.
Browsers Move Fast, Revocations Follow
The response from the industry was swift. Google's Chrome Root Program blocked the public-key hashes of the six TLS-issuing intermediates through a CRLSet update at 19:45 UTC on October 17, and Mozilla pushed a OneCRL block to Firefox by 22:59 UTC the same day -- neither requiring a user update or restart. Apple blocked the certificates on October 19 and Microsoft on October 20.
eMudhra revoked its eight certificates on October 18 with the reason "cACompromise". The affected certificates had been cross-signed by Sectigo, whose AAA Certificate Services trust some clients rely on; Sectigo revoked its cross-signed copies a day later on the same ground.
Security fixes have flowed through the software ecosystem since: Firefox 158.0.1, Go 1.27.3 and 1.26.10, Python certifi 2026.10.19, updated Linux ca-certificates packages and fixed Node.js releases have all landed. However, clients without effective revocation checking may remain exposed until their software or trust stores are updated.
Shares Plunge, Government Steps In
The market reaction has been severe. Shares of eMudhra Ltd tumbled 14 per cent on Thursday to Rs 369.40 apiece, extending a three-day slide that has wiped out 34 per cent of the stock's value. The counter had already fallen 20 per cent in the previous session and 2.99 per cent on October 19.
CERT-In, India's cyber security watchdog, announced that the private keys associated with eMudhra and its certificates had been compromised. The IT Ministry said some social media accounts were indulging in fear-mongering about the incident's impact, stressing that the incident pertains to the global certificate business and its impact on Indian sites is very limited. The ministry has formed a special team to probe the matter.
eMudhra, in filings with the stock exchanges, clarified that the incident has no connection with its Indian Digital Signature Certificate (DSC) and eSign businesses. The global TLS business runs on infrastructure completely separate from the India DSC business, which remains regulated by the Controller of Certifying Authorities and is running normally, the company said.
It added that the affected global TLS business accounts for around 1 per cent of the company's revenue, though it acknowledged reputational risks that cannot be quantified. The company said it is working directly with customers who may be affected to provide replacement certificates so that critical services are not disrupted, and continues to work with the root programmes.
What It Means for Certificate Trust
The incident is a reminder of how much of the internet's security rests on a handful of organisations behaving correctly. Certificate authorities sit at the foundation of the encrypted web: browsers trust them to vouch for the identity of websites, and that trust is only as strong as their key-management practices.
A flaw that lets anyone recover a CA's private key from its public certificate is, in security terms, close to the worst-case scenario -- which is why the root programmes moved within hours and the cleanup continues across browsers, operating systems and cloud services.
For end users, the practical takeaway is simple: keep browsers and devices updated. The blocks were pushed automatically to most Chrome and Firefox users, but older or unmaintained systems should be brought up to date. For the industry, the eMudhra episode is likely to prompt hard questions about how key-generation ceremonies are audited -- and how a scripted test step can silently substitute a strong key for a weak one without anyone noticing for seventeen months.
(Reporting based on Business Today, Moneycontrol, GBHackers, SOCRadar and the Daily Pioneer.)