eMudhra says ceremony flaw published weak certificate keys
Original title: Certification authority eMudhra defends its laughably weak private keys
One signing key was the number 4, letting attackers forge certificates and impersonate sites.
Indian certification authority eMudhra said a flaw during an April 30, 2025 key-generation ceremony, run on FIPS 140-2 Level 3 HSMs, produced a second set of weak private keys that were published to browser root stores. One key was the number 4 and others were short two- or three-digit values, which can be deduced to forge certificates. The company says it is replacing affected certificates and still investigating the root cause.
Unconfirmed: eMudhra's explanation of a wrap/unwrap flaw is its own claim, and it says the root cause is not yet established.
- eMudhra says a wrap/unwrap step created the weak keys beside strong ones.
- The company says the roots passed two years of independent audits.
- Roots have been in browser trust lists since mid-2025.
- eMudhra says its TLS business is one percent of revenue.
- The company is working with customers and root programs on replacements.
Impact: Forge certificates and impersonate websites or other resources
| Product | Affected |
|---|---|
| eMudhra certificate authority keys | — |
- 1.Replace certificates signed by the affected eMudhra roots.
From the original article
2 min read at theregister.comIndian certification authority eMudhra has defended the laughably weak private keys it used to sign some digital certificates it issued, and suggested others should share the blame for the incident.
By Simon Sharwood · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.