eMudhra Certificate Key Compromise Prompts Browser Blocks and Indian Government Probe

The problem centres on eight intermediate certificate authority certificates belonging to eMudhra, an Indian digital certificate provider. Their private keys were so weak that researchers could recover them almost instantly, according to BleepingComputer.

An intermediate certificate authority signs other certificates. Someone holding its private key could forge trusted certificates, making this a threat to the system browsers and applications use to establish trust, rather than simply a problem with eight individual websites. The Next Web reported that the keys could be calculated from the certificates themselves.

One recovered private key was simply the number 4, according to The Register. The central failure described in the coverage is weak key generation, not a reported theft of securely generated keys.

On October 19, 2026, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised, according to The Cloudflare Blog. Those certificates were widely trusted by browsers and other software.

On October 20, Mozilla and Google's Chrome Root Program confirmed the compromise, The Hacker News reported. The discovery triggered emergency fixes across browsers and software.

By October 21, eMudhra had revoked the eight affected intermediate certificates, while Mozilla, Google and Apple had blocked them, according to BleepingComputer. Revocation and browser blocks were intended to stop software trusting certificates associated with the compromised keys.

The Indian government's response followed. On October 21, NDTV India reported that the Ministry of Electronics and Information Technology had constituted a special investigation team. The government also said electronic signature services were not affected. Times now reported its assurance that the impact on Indian websites and applications remained "very limited".

On October 22, attention turned to eMudhra's internal controls. Business Line - Home reported that its board would consider structural changes on Thursday. Co-Founder Kaushik Srinivasan described the problem as a "one-time-one-client" incident and said the weak keys had been missed despite maker-checker controls.

The affected intermediate certificates have been revoked and blocked by major browser companies, but the investigation into how they were generated remains open. CERT-In has issued an advisory urging browser and operating system updates and certificate replacement, according to Business Line - Home.

The government's limited-impact assessment sits alongside a serious technical exposure: recoverable signing keys could allow forged certificates. That capability is not itself evidence that attackers used the keys. The supplied coverage does not establish whether malicious certificates were issued or users were impersonated.

There are also questions about oversight. According to The Defiant, eMudhra said the flaw went undetected through two independent audit cycles. That adds an audit question to the failure of internal checks described by Srinivasan.

The next concrete developments are the special team's findings and the outcome of the board's planned discussion on structural changes. The investigation needs to establish how the weak keys were generated and why checks failed to detect them.

For affected certificate users, the immediate issue is completing replacements and applying software updates, as advised by CERT-In in Business Line - Home. A further unresolved question is whether investigators find evidence that anyone exploited the compromised keys.