Explained: eMudhra’s weak private keys used to issue website certificates were exposed; what it means
eMudhra, a Bengaluru-based publicly listed company and one of India's licensed certificate authorities, suffered a security breach involving poorly configured private keys used to issue website certificates. Researchers discovered that the keys consisted only of numbers below 256, making them easily recoverable. AI agents helped expose the vulnerability—researcher Dennis Jackson reported that an AI tool recovered a key on the first attempt with a simple prompt. Mozilla and Chrome blocked the affected certificates on October 17, and eMudhra revoked them the next day. While the compromised certificates represented only about 1% of eMudhra's revenue, the company warned of unquantifiable reputat
Key points
- eMudhra exposed weak private keys usable to forge trusted website certificates
- AI agents discovered the flaw rapidly; Mozilla independently recovered keys within hours
- Browser vendors blocked certificates; eMudhra revoked them within 24 hours of disclosure
- Affected business represents ~1% of revenue but poses significant reputational risk
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. MediaNama did the reporting; read the original for the full story.
Read the full story at MediaNama
