What does eMudhra’s web security key leak mean for internet users? | Explained

The story so far: Eight private keys used to issue web security certificates by Bengaluru-headquartered eMudhra Ltd were exposed, it emerged on Tuesday (October 20, 2026). The incident has prompted an advisory by the Computer Emergency Response Team, India (CERT-in) and immediate patches from developers of major web browsers. eMudhra’s services are used across several government and public sector bank websites.

Web security

The internet relies on a small number of so-called “root” certifying authorities (CAs) who can then authorise intermediate CAs to issue SSL certificates for webpages. Those SSL certificates are on practically every website, acting as an assurance that a website is what it claims to represent. This system works on trust, and only a handful of root CAs are trusted by browsers around the world. eMudhra operates one of these trusted CAs.

CAs use a private key to sign their certificates that are issued to websites. Exposing this private key allows anyone to make a copy of the certificate and apply it to an illegitimate site, allowing so-called man-in-the-middle attacks, where a user’s traffic is intercepted and redirected to a malicious source. This possibility became open as soon as eight of eMudhra’s intermediate CA certificates were exposed.

Critical flaw

A private key is part of a cryptographic pair in secure communications, with a public key being used in combination with it to create a message that disallows interception. This is done through mathematical one-way functions that make it possible for two pairs of public and private keys to be used to encrypt messages, without ever being able to infer the other party’s private keys. Variations of this technology are used everywhere from issuing SSL certificates to securing WhatsApp messages. 

eMudhra’s mistake was in making a private key in its SSL certificate issuance process so small — just one to three characters long, instead of hundreds — that the private key in eight of its intermediate CAs was exposed by a security researcher, and potentially anyone who spent some effort in discovering the same vulnerability. 

“Upon becoming aware of the incident, eMudhra initiated its incident response procedures, took measures to contain the affected certificates, and began working closely with browser and root-store operators to safeguard users and maintain the integrity of the broader WebPKI ecosystem,” eMudhra said on its website. 

One of the CAs was actively being used in production in an unnamed U.S. industry, the company said. 

Ramifications

Yash Kadakia, founder of the Security Brigade cybersecurity firm, said that the impact of this leak, even if patched on browsers, could extend to internet-of-things (IoT) devices that are not frequently patched to address certificate compromise incidents like this. “The cleanup could be enormous, particularly for devices and software that cannot be easily updated,” Mr. Kadakia said.

Those devices that cannot be updated, may be vulnerable to these MITM attacks, which would take advantage of outdated trusted certificate stores preloaded in them, and spoof online messages that would make the devices act unpredictably. 

Many government websites, including the Aadhaar issuer UIDAI and the income tax filing portal, use eMudhra certificates or other technology from the firm. The IT Ministry insisted in a statement that these are separate systems that are not a part of eMudhra’s eSign business for digitally signing documents, or the SSL certificates used in government sites.

Since the web security industry is built on trust, however, this reputational hit may hit the firm in particular very heavily, as customers and browser developers alike reassess whether eMudhra’s certificates are reliable or not.