Overview
- In October 2026 researchers reconstructed eight eMudhra intermediate private keys that were generated with almost no randomness, a flaw the company says came from a key‑generation error in April 2025.
- Google, Mozilla, Apple and Microsoft moved to block or withdraw trust in certificates linked to the weak keys and eMudhra revoked the eight affected intermediates within hours.
- eMudhra announced it will withdraw from the global website‑certificate business, said no infrastructure breach or customer data loss occurred, and pledged free certificate replacements for affected customers.
- Indian authorities including MeitY and CERT‑In have opened investigations and issued advisories, while security experts and civil groups are calling for independent forensic audits and clearer regulator action.
- Experts warn long‑term risk remains because older devices and bespoke systems with embedded trust stores may not receive updates, leaving some services potentially vulnerable for years.