# eMudhra exits global certificate business after weak key flaw 2026-10-23T03:04:23+00:00 | Technology | Indian Opinion Desk Corroboration: 4 independent outlets eMudhra has withdrawn from the global SSL/TLS certificate business after eight cryptographic keys generated in April 2025 were found to be recoverable from their public counterparts. The company said the affected certificates were revoked within 14 hours of discovery on 17 October and no end-entity certificates had been issued through them. The flaw originated in a key-wrapping script error that produced weak keys alongside intended strong keys, with the weak ones published to browser root stores, co-founder Kaushik Srinivasan told ET. Browser makers including Google, Apple and Microsoft have blocked the affected certificates. The Ministry of Electronics and Information Technology set up a special team to investigate, stating on 22 October that impact on Indian websites was ‘very limited’. Experts remain concerned that server-side applications maintaining their own certificate trust stores may not receive the same updates, Business Today reports. eMudhra's shares fell 40% over two days following the disclosure. Update, 23 October 2026: India Today adds a quote from teen hacker Nisarga Adhikary calling the flaw an ‘absolute disaster’ that could have broken the internet, and reports that the weak keys were as short as two-digit numbers. The other three outlets confirm the company's business exit and government probe, with Hindustan Times naming Infosys and TCS as eMudhra customers and Business Today detailing server-side residual risk. ## Indian Opinion Analysis Business Today and India Today lead with the technical flaw and expert commentary, framing the incident as a fundamental failure of cryptographic trust. Hindustan Times and Economic Times foreground eMudhra's business exit and the government probe, giving the company's defence more space, calling scrutiny ‘disproportionate’. Hindustan Times is the only outlet to name eMudhra's customers, including Infosys and the income-tax portal, which sharpens the stakes. India Today adds the teen hacker’s ‘absolute disaster’ label, a dramatic touch the others avoid. The core facts are uniform across all four: eight weak keys generated in April 2025, revocation within hours, and the company pulling out of the global certificate business. Where they differ is tone, Business Today and India Today stress the near-miss and system risk, while Hindustan Times and Economic Times give equal weight to eMudhra’s business decision and the government’s limited-impact assessment. ## Coverage Coverage: 4 sources, 3 neutral, 1 sensationalist - businesstoday.in (neutral report) Leads with expert commentary on systemic risk - hindustantimes.com (neutral report) Gives company defence and customer names - economictimes.indiatimes.com (neutral report) Defence-focused interview with co-founder - indiatoday.in (sensationalist) Sensationalist framing via teen hacker quote This brief was synthesised by AI from the 4 sources linked above, so one read covers every framing they carry. Tags: CERT-In, Cloudflare, eMudhra, Google, MeitY Canonical: https://indianopinion.org/emudhra-quits-global-certificate-business-after-key-flaw/ License: Summary and commentary (c) Indian Opinion, reusable with attribution. Facts belong to the linked sources. Cite: https://indianopinion.org/emudhra-quits-global-certificate-business-after-key-flaw/#story-in-brief How this brief was made: an AI model read the reports linked above and wrote this summary and analysis, which were published automatically. Published briefs are sampled every hour by an automated quality check; the editor verifies its findings and approves corrections, and corrected briefs carry a dated correction line. Stance labels are editorial classifications of how each outlet framed this story, assigned by the same model, not ratings of the outlets. We do no original reporting. Methodology: https://indianopinion.org/ai-use-policy/