Now Reading: eMudhra exits global certificate business after weak key flaw
-
01
eMudhra exits global certificate business after weak key flaw
The Story in Brief
eMudhra has withdrawn from the global SSL/TLS certificate business after eight cryptographic keys generated in April 2025 were found to be recoverable from their public counterparts. The company said the affected certificates were revoked within 14 hours of discovery on 17 October and no end-entity certificates had been issued through them. The flaw originated in a key-wrapping script error that produced weak keys alongside intended strong keys, with the weak ones published to browser root stores, co-founder Kaushik Srinivasan told ET.
Browser makers including Google, Apple and Microsoft have blocked the affected certificates. The Ministry of Electronics and Information Technology set up a special team to investigate, stating on 22 October that impact on Indian websites was ‘very limited’. Experts remain concerned that server-side applications maintaining their own certificate trust stores may not receive the same updates, Business Today reports. eMudhra's shares fell 40% over two days following the disclosure.
Update, 23 October 2026: India Today adds a quote from teen hacker Nisarga Adhikary calling the flaw an ‘absolute disaster’ that could have broken the internet, and reports that the weak keys were as short as two-digit numbers. The other three outlets confirm the company's business exit and government probe, with Hindustan Times naming Infosys and TCS as eMudhra customers and Business Today detailing server-side residual risk.
Indian Opinion Analysis
Business Today and India Today lead with the technical flaw and expert commentary, framing the incident as a fundamental failure of cryptographic trust. Hindustan Times and Economic Times foreground eMudhra's business exit and the government probe, giving the company's defence more space, calling scrutiny ‘disproportionate’. Hindustan Times is the only outlet to name eMudhra's customers, including Infosys and the income-tax portal, which sharpens the stakes. India Today adds the teen hacker’s ‘absolute disaster’ label, a dramatic touch the others avoid. The core facts are uniform across all four: eight weak keys generated in April 2025, revocation within hours, and the company pulling out of the global certificate business. Where they differ is tone, Business Today and India Today stress the near-miss and system risk, while Hindustan Times and Economic Times give equal weight to eMudhra’s business decision and the government’s limited-impact assessment.
Coverage: 4 sources, 3 neutral, 1 sensationalist
Sources (4): businesstoday.in (neutral report), hindustantimes.com (neutral report), economictimes.indiatimes.com (neutral report), indiatoday.in (sensationalist)
This brief was synthesised by AI from the 4 sources linked above, so one read covers every framing they carry. Methodology and corrections.
