eMudhra's Eight Weak Keys Prompt Google, Mozilla Blocks in April 2025

In April 2025, eMudhra’s eight weak private keys—one with the value 4—were discovered to be recoverable in seconds, a flaw that allowed the company to re‑sign revoked certificates with the same compromised keys.

Google and Mozilla immediately added the affected certificates to their revocation lists, effectively blocking them in all major browsers, but investigators have not found evidence that attackers exploited the keys.

Apar Gupta of the Internet Freedom Foundation slammed the lapse as negligence, noting that eMudhra had undergone two years of independent audits yet the flaw persisted for 18 months.

The Controller of Certifying Authorities, which receives eMudhra’s annual audit reports, has yet to disclose whether its review caught the weak key generation, while the government insists eMudhra’s Digital Signature Certificate services remain unaffected.

Cybersecurity experts warn that browsers are not the only consumers of the trust store; enterprise servers, embedded devices, and cloud workloads may still trust the compromised certificates unless they perform manual updates.

The next phase will see a parliamentary committee holding a hearing on eMudhra’s audit practices in June 2026, with industry stakeholders urging tighter oversight and a national cybersecurity policy overhaul.