eMudhra clarified that the incident has no connection with eMudhra’s Indian Digital Signature Certificate (DSC) and eSign businesses. The global TLS business runs on infrastructure that is completely separate from the India DSC business. DSC and eSign services in India are running normally, it said.
eMudhra added that an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques and reported this to the major root programs such as Apple, Google, Microsoft and Mozilla, eMudhra said on Wednesday.
"The affected global TLS business is a very small part of eMudhra’s operations and accounts for around 1 per cent of the company’s revenue. However, this may have some reputational risks on eMudhra which cannot be quantified," it said.
eMudhra said it was working directly with customers who may be affected to give them replacement certificates, so that critical services are not disrupted. The company is also working with the root programs and continues its root-cause investigation.
The matter related to eight of eMudhra’s several intermediate CAs that were trusted as part of its Global TLS business. These issuing CAs were created under eMudhra’s ECC root in a Key Generation Ceremony (KGC) held on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules (HSMs).
"A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the
original strong keys. The weak keys were the ones published to the browser root stores. eMudhra is working to establish the root cause. These roots and issuing CAs have gone through independent audits for two years in a row, and have been in browser trust lists since mid 2025," it noted.
Disclaimer: Business Today provides stock market news for informational purposes only and should not be construed as investment advice. Readers are encouraged to consult with a qualified financial advisor before making any investment decisions.