EMudhra

eMudhra Limited
TypePublic
NSE: EMUDHRA
IndustryCertificate authority
Founded2008
HeadquartersBengaluru, Karnataka, India
Key people
  • Venkatraman Srinivasan (founder)
Websiteemudhra.com
Logo of emSign, the brand name used for certificates

eMudhra Limited is an Indian certificate authority founded in 2008. As of 2026, the company has issued more than 60 million digital certificates.

In October 2026, the private keys of eight of its intermediate certificates were found to be extremely weak, leading browser vendors to block the certificates.

History

In 2026, eMudhra began a partnership with LankaSign.

2026 intermediate certificate compromise

On October 17, 2026, browser root programs received a report that the private keys of eight eMudhra intermediate certificates had been compromised.

The private keys were 4, 56, 66, 115, 155, 156, 230, and 237. A P-384 elliptic-curve private key normally has about 384 bits of entropy, but these keys had between 3 and 8 bits. Security researcher Scott Helme said he had recovered several of the keys from the certificates' public keys in less than a second. Because the keys could be recovered from the public certificates, anyone could have used them to issue certificates for any website that browsers would trust. As of 20 October 2026, the cause of the weak keys had not been determined.

Google Chrome and Firefox blocked the certificates within hours of the report. Apple followed on October 19 and Microsoft on October 20. eMudhra revoked the eight certificates. On October 20, Mozilla removed the root certificate that had issued them, emSign ECC Root CA – G3, from NSS, and on October 21, Google stated that Chrome would also remove the root certificate from its Chrome Root Store by the morning of October 27. The cleanup is expected to take a long time, because many Linux distributions, embedded devices, and applications ship their own copies of root certificates.

On October 21, eMudhra issued a public statement regarding the incident. Many Indian government websites used eMudhra for certificates, including Aadhaar issuer UIDAI and its income tax portal. Revocation of eMudhra certificates has caused several websites from being inaccessible, including government websites such as FSSAI and Higher education department of Kerala.

See also

References

  1. ↑ "Leadership Team at eMudhra - Meet Our Executives - India". emudhra.com. Archived from the original on May 21, 2026.
  2. 1 2 3 4 Sharwood, Simon (October 20, 2026). "Indian certification authority eMudhra's private keys compromised – one of them was the number '4'". theregister. Retrieved October 21, 2026.
  3. ↑ "eMudhra and LankaSign announce strategic partnership to make digital signing seamless". The Island. January 2, 2026.
  4. 1 2 3 Firefox Security Team (October 20, 2026). "Protecting Firefox users following the compromise of eMudhra intermediate certificates". Mozilla Security Blog.
  5. 1 2 3 4 5 Goodin, Dan (October 20, 2026). "The Internet goes on high alert after discovery of 8 compromised TLS certs". Ars Technica. Archived from the original on October 20, 2026. Retrieved October 20, 2026.
  6. ↑ "Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates". Google. October 20, 2026. Retrieved October 21, 2026.
  7. ↑ 認証局eMudhraの中間証明書、秘密鍵が「数ミリ秒」で復元可能な脆弱性 大手各社が緊急遮断. ITmedia NEWS (in Japanese). October 21, 2026. Retrieved October 21, 2026.
  8. ↑ "eMudhra Statement on Recent Certificate Security Incident". emudhra.com. October 20, 2026. Retrieved October 22, 2026.
  9. ↑ "Eight web security keys of eMudhra firm used by Govt. and PSUs leaked". The Hindu. October 21, 2026. ISSN 0971-751X. Retrieved October 22, 2026.
  10. ↑ pranay (October 21, 2026). "SFLC.in's Statement on eMudhra Private Key vulnerability". Retrieved October 22, 2026.