eMudhra pulls out of digital certificate market after key security flaw revealed

Indian technology firm eMudhra said on Tuesday it will stop issuing digital certificates after a serious security lapse was exposed by an independent researcher.

The flaw came to light when cybersecurity specialist Scott Helme posted a detailed blog entry showing that one of eMudhra’s private signing keys, which should have been a randomly generated 384‑bit value, was in fact the literal integer four. The discovery demonstrated that the cryptographic material used to sign certificates was effectively predictable.

A private key of that nature defeats the core purpose of public‑key infrastructure. If an attacker can guess or reconstruct the key, they can forge certificates that appear to be issued by the trusted authority, potentially enabling man‑in‑the‑middle attacks on web traffic, email, and other encrypted communications.

In a brief statement, eMudhra acknowledged the vulnerability and said it would immediately cease all certificate‑related services while it works with clients to transition to alternative providers. The company also pledged to conduct a full forensic review and to cooperate with any regulatory inquiries.

The announcement has left thousands of organizations that rely on eMudhra’s SSL/TLS and code‑signing certificates searching for replacements. Industry analysts note that the sudden loss of a regional certificate authority could cause short‑term disruption, especially for businesses that have embedded the provider’s root certificates into internal systems.

The incident underscores growing concerns about the robustness of the global PKI ecosystem. Past breaches, such as the DigiNotar hack in 2011, have shown how a compromised certificate authority can erode trust across the internet. Experts say regular third‑party audits and transparent key‑management practices are essential to prevent similar failures.

Regulators in India have not yet issued formal guidance, but the Ministry of Electronics and Information Technology has indicated that it will review the case to determine whether existing compliance frameworks need tightening. Observers expect that eMudhra may either re‑enter the market after a comprehensive overhaul or pivot to other cybersecurity services.

Customers who have already deployed eMudhra‑signed certificates are being advised to revoke them and replace them with credentials from other authorities. While the company assures that no active exploit has been detected, the mere existence of a predictable key has prompted many security teams to treat the situation as a high‑severity incident.