eMudhra faces a bigger test of public trust

eMudhra has decided to exit its global website certificate business, a decision that highlights a significant security issue within the company. In an interview, co-founder Kaushik Srinivasan revealed that the issue stemmed from a script error and human oversight during a key-generation ceremony on April 30, 2025. The company's report confirms that while the affected keys conformed to policy, their strength was weak.

This oversight went undetected for about 18 months despite two external audit cycles. Mozilla, a browser operator, warned that attackers could potentially impersonate websites and intercept user traffic using these compromised keys. Srinivasan clarified that no customer data was compromised and that the Indian digital-signature and eSign services remained unaffected.

The company's board decided to exit the business due to the disproportionate scrutiny it brought and the limited return on investment. Srinivasan emphasized that the company's G1 root certification, which browsers trust to verify website security, remains unaltered. Looking ahead, Srinivasan highlighted the increasing role of AI in generating attack vectors, urging continuous security checks and the use of AI to verify digital keys throughout their lifecycle.

The company plans to appoint an independent auditor to review its cryptographic estate and assess its processes.