Where Exactly Did eMudhra Go Wrong in Its Security Incident?

Indian cybersecurity company eMudhra has disclosed the technical details behind the weak cryptographic keys that triggered widespread concern across the internet last month. In a detailed report published on the open-source bug-tracking platform Bugzilla, the company attributed the incident to an error in a custom Python script. The issue involved eight weak keys used to issue digital certificates for websites. Such certificates help browsers verify website identities and establish secure connections. However, the affected keys were so short and easy to guess that they could potentially have been exploited to obtain fraudulent certificates and create fake websites to deceive users. In one particularly alarming case, a key was reduced to the number 4.

According to eMudhra’s report, the keys were originally generated successfully on a Hardware Security Module (HSM) during a key-generation ceremony on April 30, 2025. Problems arose when the company used a custom Python script to process the keys before transferring them to another hardware device located in a different geographical location. A bug in the script reduced eight keys to the numbers 4, 56, 66, 115, 155, 156, 230 and 237. The company acknowledged that these values were so small that they could have been easily discovered by anyone using publicly available information. The weak keys remained undetected for around 18 months because they continued to issue certificates, and their strength was not independently tested. eMudhra also reported that eight other keys remained intact, but the same script created copies of them in the memory of an ordinary computer. Since the company could not guarantee that all the affected keys complied with its security policy, it revoked all 16 associated certificates.

The report described this as the first time eMudhra had used such a process to transfer keys between Hardware Security Modules located in different geographical regions. The company said it has since changed its approach and now generates keys without transferring them between devices. Following the controversy, eMudhra exited the TLS digital certificate business entirely and publicly apologised for the incident. The discovery had raised serious concerns among cybersecurity experts, with some warning that the weakness could have posed a major threat to internet security. Google, Mozilla, Apple and Microsoft also released security updates following the disclosure. The incident has once again highlighted the importance of secure key management, rigorous testing and independent verification in the digital certificate ecosystem.