Eight weak cryptographic keys, 18 months of undetected exposure, and a decision to exit the global SSL/TLS certificate business. The eMudhra incident offers an important lesson for enterprise cybersecurity leaders.
What Actually Happened at eMudhra?
In October 2026, Indian digital trust company eMudhra came under global scrutiny after a security researcher discovered serious weaknesses in eight intermediate Certificate Authority (CA) certificates associated with its international SSL/TLS business.
Digital certificates help browsers and applications verify that they are communicating with legitimate websites and services. They form an essential part of the trust infrastructure behind secure online communications.
Incident at a Glance
Affected intermediate CA certificates
8 certificates
Approximate undetected exposure
18 months
Initial cryptographic key-generation issue
30 April 2025
The problem began on April 30, 2025, during a cryptographic key-generation procedure. According to eMudhra, a flaw in a key wrap/unwrap step resulted in a second set of unusually weak cryptographic keys being generated. These weaker keys were subsequently published as part of its certificate hierarchy.
The weakness made the corresponding private keys extremely easy to recover, potentially allowing malicious actors to create fraudulent certificates that could be used to impersonate trusted websites or software publishers.
The incident remained undetected for approximately 18 months, despite the certificate hierarchy passing two independent audit cycles.
How the Incident Unfolded
30 April 2025
Cryptographic Key Generation
A flaw in a key wrap/unwrap step resulted in the generation of unusually weak cryptographic keys.
17 October 2026
Researcher Reports the Weakness
An independent researcher reported the weakness in the affected intermediate certificates.
18 October 2026
Affected Certificates Revoked
eMudhra revoked all eight affected intermediate certificates while major browser and operating-system vendors moved to block trust in the affected certificate hierarchy.
22 October 2026
SSL/TLS Business Exit Announcement
eMudhra announced that it would voluntarily withdraw from the global SSL/TLS certificate business.
What the Incident Does — and Does Not — Mean
An important distinction: eMudhra has stated that its infrastructure was not breached, no customer data was compromised, and none of the eight affected intermediates had issued end-user certificates.
Its Indian Digital Signature Certificate and eSign businesses remain unaffected.
The exact root cause is still under investigation. The incident was therefore primarily a failure of cryptographic trust assurance, rather than a confirmed cyberattack involving stolen customer information.
Why This Matters Beyond eMudhra
The incident highlights a broader cybersecurity challenge: even technologies designed to establish trust require continuous validation.
A system can use certified hardware, meet established security standards, and pass independent audits while still containing weaknesses that create significant risk.
For enterprises, this matters because cybersecurity dependencies extend far beyond their own networks. Applications, cloud platforms, identity systems, certificates, software suppliers, and external service providers all contribute to an organization’s security posture.
If a critical dependency is no longer trusted, the consequences can include service disruption, urgent certificate replacement, additional security investigations, and reputational damage.
Most importantly, compliance provides assurance at a point in time. Cyber resilience requires continuous verification.
Key Takeaway
Compliance provides assurance at a point in time. Cyber resilience requires continuous verification.
Expert Perspective
“Cybersecurity cannot stop at compliance certifications or periodic audits. Enterprises need continuous visibility into their security dependencies, stronger third-party risk governance, and the ability to respond quickly when trusted systems are called into question. Digital trust must be continuously validated, not simply assumed.”
Niraj Kumar
Cybersecurity Practice Leader
Progressive Techserve
What Should CIOs, CISOs and IT Leaders Do?
The eMudhra incident reinforces five priorities for enterprise cybersecurity leadership.
1 Know Your Digital Trust Dependencies
Maintain visibility into certificates, certificate authorities, third-party security providers, and critical applications. Identify which business services depend on each trust relationship and who owns the associated risk.
2 Move Beyond Periodic Security Assessments
Supplement compliance audits with continuous security assessments, configuration reviews, vulnerability management, and independent validation of critical controls. For sensitive cryptographic processes, verify that key-generation and key-management procedures are independently tested.
3 Strengthen Third-Party and Supply-Chain Security
Evaluate critical vendors for security practices, incident response capabilities, resilience, and business continuity. Avoid unnecessary dependence on a single trust provider where viable alternatives exist.
4 Monitor and Validate Trust Continuously
Implement certificate lifecycle visibility, monitor unexpected certificate issuance, verify revocation and trust-store updates, and investigate unusual authentication or communications activity.
5 Prepare for Trust-Related Incidents
Maintain tested procedures for replacing certificates, updating dependent systems, responding to compromised credentials or keys, and communicating with affected stakeholders. A successful response depends on knowing what is affected before an incident occurs.
The objective is not to eliminate every possible vulnerability. It is to ensure that weaknesses can be identified, contained, and resolved before they escalate into business disruption.
How Progressive Techserve Helps Strengthen Cyber Resilience
At Progressive Techserve, we help enterprises move from periodic security checks toward continuous cyber risk management through an AI-Augmented, Human-Led managed services model.
Our Relevant Cybersecurity Services Include:
✓ Security Advisory & Risk Assessments
Evaluate enterprise security maturity, critical dependencies, third-party exposure, and control effectiveness.
✓ VAPT, Application Security & CTEM
Identify vulnerabilities, continuously evaluate exposure, and prioritize remediation based on business risk.
✓ 24×7 Managed AI SOC & MDR
Monitor security events, correlate threats, investigate suspicious activity, and support timely containment.
✓ Incident Response & Digital Forensics
Support investigation, root-cause analysis, containment, and recovery when security incidents occur.
✓ Governance, Risk & Compliance
Strengthen security governance and support alignment with established cybersecurity frameworks.
Our approach combines continuous monitoring, intelligent automation, and experienced security professionals to help enterprises improve visibility, reduce exposure, and strengthen resilience.
Digital trust is essential. Continuous assurance is what helps sustain it.
Build Stronger Digital Trust
Strengthen Your Enterprise’s Cyber Resilience
Improve visibility into security dependencies, reduce third-party risk, and strengthen your organization’s ability to respond to emerging cyber threats.
Contact Our Security TeamSources & Editorial Note
Incident facts and timeline: eMudhra certificate security incident statement; CERT-In advisory; eMudhra exit announcement (22 October 2026).
Progressive Techserve • AI-Augmented | Human-Led