eMudhra faces scrutiny after weak certificate keys raise web security concerns
Eight intermediate certificate authority keys linked to eMudhra's global website-security operations were found to be dangerously weak, potentially enabling fraudulent HTTPS certificate creation and website impersonation. Generated April 30, 2025, the weakness went undetected until October 21, 2026. A flaw in eMudhra's key-wrap/unwrap procedure during key generation produced the weak keys, which were published to browser root stores. While eMudhra's root private key remained secure, browser operators withdrew trust from the emSign ECC Root CA - G3 as a precaution. MeitY clarified eMudhra's international certificate business operates under a global trust framework separate from its domestic d
Key points
- Eight weak intermediate CA keys remained undetected for 18 months
- Flaw in key-generation procedure created second weak key set
- Browsers withdrew trust from emSign ECC Root CA - G3
- MeitY clarified international certificate business separate from domestic operations
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. YourStory did the reporting; read the original for the full story.
Read the full story at YourStory
