Author: Nishtha Mehrotra | EQMint

Synopsis:

• • Eight dangerously weak cryptographic keys linked to eMudhra triggered security action by major browser makers.

• • Mozilla removed an eMudhra root certificate from its trusted list, while Google announced plans to follow.

• • eMudhra shares hit the 20% lower circuit as the company estimated the affected business contributed around 1% of its revenue.

eMudhra weak-key vulnerability has triggered a global cybersecurity scare, raising concerns about the digital certificates that help secure internet connections. The Bengaluru-based certificate authority faced scrutiny after a researcher discovered eight cryptographic keys that could reportedly be recovered almost instantly.

The incident prompted major technology companies to restrict trust in affected certificates, highlighting the risks posed by weaknesses in systems that underpin online security.

How Did the Vulnerability Occur?

Digital certificates help browsers verify website identities and establish secure connections. Certificate authorities such as eMudhra issue these certificates, making the security of their systems critical to internet trust.

According to Mozilla engineer Dennis Jackson, all eight affected private keys were dangerously weak, with one reportedly set to the number four. Such weaknesses could potentially allow attackers to impersonate websites or sign malicious software using compromised credentials.

The affected certificates included six used for website security and two intended for software code signing.

What Went Wrong at eMudhra?

The company attributed the problem to a software scripting error during the preparation of cryptographic keys for transfer between data centres.

According to eMudhra, the process inadvertently generated a second, weaker set of keys. Employees subsequently used these weak keys by mistake.

The company said only one of the eight keys had been used and that none had issued certificates to end customers. It also stated that its systems had not been breached, no data had been lost, and its Indian Digital Signature Certificate and eSign services operated separately.

Browser Makers Withdraw Trust

The vulnerabilities were reported on October 17, 2026, prompting action from Google, Mozilla, Apple and Microsoft. Firefox blocked the affected certificates, while other browser makers implemented security restrictions.

Mozilla subsequently removed the emSign ECC Root CA – G3 certificate from its trusted list. Google announced plans to remove the same root from Chrome, with action scheduled for October 27.

India’s cybersecurity agency CERT-In also issued an advisory urging organisations to update browsers and operating systems, replace affected certificates and avoid bypassing security warnings.

The changes could disrupt legitimate services using certificates linked to the affected chain. eMudhra estimated that approximately 30,000 customer certificates under the affected root would need to be migrated.

eMudhra Shares Hit Lower Circuit

The cybersecurity incident also affected investor sentiment. eMudhra shares fell 20% to the lower circuit of ₹432, compared with an opening price of ₹520, according to the supplied report.

The company estimated that the affected business contributed around 1% of its revenue. However, reputational damage and the future of its international certificate business remain key concerns.

The incident underscores the importance of secure key generation, rigorous software testing and strict operational controls. The future treatment of eMudhra’s remaining root certificates by major browsers will be an important development to watch.

Source: https://shrts.in/w6ovvw2wo7

Disclaimer: This article is for information purposes only and is not investment advice.

For more such information, visit EQMint

Join our WhatsApp channel for timely updates: Whatsapp