eMudhra quits the global site padlock business after a weak key flaw

Picture a lock whose secret key is the number 4. Not a long, random code. Just 4. That is what a researcher found inside part of the online security system run by Indian company eMudhra. One of its secret keys turned out to be the number 4.

Five days later, on Thursday, 22 October 2026, eMudhra said it would voluntarily withdraw from the global SSL/TLS certificate business. In simple words, it will stop selling the digital "padlocks" that sites around the world use. Here is what that business is, what went wrong, and why the world's biggest browsers stepped in.

First, what is that padlock in your browser?

When you open a site, your browser often shows a small padlock next to the address. That padlock comes from an SSL/TLS certificate. Think of it as a stamped ID card that a shop shows at the door to prove it is the real shop and not a fake one. It also makes sure that what you type, like a password, travels in a locked box that nobody in between can open.

Who stamps these ID cards? A certificate authority, or CA. It is like the office that issues ID cards. Browsers such as Chrome and Firefox keep a list of CAs they trust. If a CA is on the list, every card it stamps is trusted too.

eMudhra, a Bengaluru-based cybersecurity company, was one of these CAs. In India it is better known for digital signature certificates, the online signatures people use to file papers on government portals such as GST and income tax.

What went wrong with the keys?

Every CA holds private keys. A private key is like the rubber stamp in the ID office. Whoever holds it can stamp new cards. So it must be a huge, random number that nobody can guess.

On 17 October 2026, a researcher named Wayne reported that he had worked out the private keys of eight of eMudhra's in-between certificates, called intermediate CAs. The keys were not stolen. They had been made with extremely small numbers that were easy to guess. The eight values were 4, 56, 66, 115, 155, 156, 230 and 237. Six of the keys were meant for site security and two for signing software.

According to eMudhra, the trouble began at a key-making ceremony on 30 April 2025. A flaw created a second set of weak keys next to the strong ones, and staff used the weak keys by mistake. The flaw went unnoticed for around 18 months, through two independent audit cycles. Its cofounder Kaushik Srinivasan told Inc42 it was a script error and a human oversight problem.

Why did Google and Mozilla step in?

If someone has a CA's stamp, they could make a fake ID card for any site. A fake bank page could then look real to a browser. That is why browsers moved fast.

Google's Chrome team got the report at 18:05 UTC on 17 October. By 19:45 UTC, it had blocked the affected certificates, without users needing to update or restart. Google also said no site certificates from these six CAs had been publicly logged before the block, so no fake ones could have been used against Chrome. Mozilla also blocked the eight certificates within hours, and on 20 October removed eMudhra's emSign ECC Root CA G3 from its trusted list.

A root is the top stamp that all the lower stamps hang from, like a head office above branch offices. Chrome will also drop the G3 root from its list on 27 October 2026, and Google said it is reviewing whether eMudhra's other CAs should stay trusted. Apple and Microsoft also moved to distrust the affected certificates.

Two panels: before 17 October eMudhra sold trusted certificates to sites around the world; on 22 October it announced its exit and said customers will move to other providers free of charge — In five days, a trusted business turned into an exit.

Watch on YouTube

Why leave the business, and not fix it?

eMudhra said it revoked the affected CAs within 14 hours of learning about the problem. It said none of the eight had issued certificates to end users, its systems were not broken into, and no data was leaked.

But the damage to its trust was big. Srinivasan said the impact had been "quite severe" over 24 to 48 hours, and that the board felt it was wise to withdraw, given its duties as a listed company. A listed company is one whose shares are bought and sold on the stock market.

Money also played a part. This global business brought in only about 1% of eMudhra's revenue. Its total revenue in FY26, the money year that ended in March 2026, was ₹701.6 crore. The company also pointed to rising rule-following costs and falling returns. Let's Encrypt already gives these certificates for free, and Cloudflare plans to do the same. Think of a samosa stall when the shop next door starts giving samosas away. It is hard to earn much.

Two bars: the global TLS business was about 1% of eMudhra's revenue and the rest of the company about 99% — The business eMudhra is leaving was a tiny slice of its money.

What happens to customers now?

eMudhra said current customers will be moved to other certificate providers free of charge over the next three to four weeks. Around 30,000 certificates in the US were already hit when the G3 root lost trust. They were first shifted to eMudhra's older G1 root, and now they have to move to another provider.

A counter rises to 30,000, with bars rising beside it, showing US certificates that had to be moved off the distrusted root — About 30,000 US certificates had to find a new home.

The company plans to appoint an auditor to write a final report on the incident in two to three weeks. It also says it will add maker-checker controls, where one person does a task and a second person checks it, like a teacher checking a classmate's answer sheet before it is handed in.

Is India affected?

eMudhra says its Indian digital signature and eSign services run on separate systems and were not affected. The IT Ministry said the impact on Indian sites was very limited, took "serious note" of the incident and formed a special team to look into it. Per Inc42, the ministry also said the impact lasted only a very short time.

Watch on YouTube

The big lesson

The internet's padlock works like a chain of trust: the browser trusts the root, the root trusts the branch, the branch vouches for the site. One weak link can break the whole chain. For a company that sells trust, trust is the product itself. Once browsers pull it back, even a business that earns just 1% of the money can be too costly to keep.

Sources

You may republish this story under CC BY 4.0: credit Pranav Sharma and link to this page.