Certification authority eMudhra defends its laughably weak private keys

Indian certification authority eMudhra has defended the weak private keys it used to sign digital certificates, blaming others for the incident. The company issued digital certificates with private keys that were easily guessable, such as "4" and short strings of two-or-three-digit numbers, leaving them vulnerable to forgery and impersonation of websites.

This left room for scammers, phishers, and other malicious actors. Industry experts have pointed out the weak keys' vulnerability and urged the adoption of stronger certificates, but eMudhra argues that replacing them will be a lengthy and burdensome task. According to the company, it generated the keys during a Key Generation Ceremony held on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules (HSMs).

However, an internal flaw caused a second set of weak keys to be produced alongside the stronger ones, and these weak keys were what was published to browser root stores. eMudhra is currently working to identify the root cause of the issue. Additionally, the company has been independently audited twice in the past year and has been in browser trust lists since mid-2025, which may deflect some blame onto auditors and other stakeholders.

The TLS business of eMudhra generates only one percent of its revenue, so the incident's financial impact on the company will be minimal. The company is actively working to replace the affected certificates for its customers, ensuring that critical services remain uninterrupted and is conducting an ongoing investigation into the root cause of the incident.

The company acknowledges that the situation may have significant reputational risks, which it cannot accurately quantify.