eMudhra Bug Sparks Security Scare, Firm Exits Business

The Cliff News | 11 November 2026

A significant security lapse involving eMudhra, a key Certificate Authority (CA) responsible for issuing digital certificates to verify website authenticity, has sent ripples through the cybersecurity landscape. The incident, stemming from a bug in the company's cryptographic key generation process, has prompted an urgent review and led eMudhra to announce its departure from the digital certificate business.

The controversy centers on the generation of cryptographic keys that were intended to be 115 digits long. However, a faulty Python script used during a key-generation ceremony on April 30, 2025, resulted in several keys being drastically shortened. In alarming instances, some keys were reduced to a mere four digits, making them easily guessable and vulnerable to exploitation by attackers.

Flawed Key Generation Process

The flawed process involved generating cryptographic keys using a Hardware Security Module (HSM), a specialized device designed for secure key management. eMudhra utilized a custom Python script to facilitate the transfer of keys between two HSMs. This script, however, contained a bug that inadvertently shortened eight specific keys.

The eight affected keys were identified as: 4, 56, 66, 115, 155, 156, 230, and 237. A key as short as '4' could be guessed almost instantaneously, posing a severe risk to the integrity of the digital certificates associated with them.

Data Exposure Risk

Adding to the concern, the Python script also created copies of these compromised keys in the memory of an ordinary computer. This meant the keys could have been exposed outside the protected environment of the HSM, significantly increasing the potential for unauthorized access and misuse.

As a precautionary measure, eMudhra subsequently revoked all 16 digital certificates linked to these eight affected keys. The company has since altered its key generation methodology, opting to generate keys without transferring them between HSMs.

Company's Response and Exit

In the wake of the incident, eMudhra issued a public apology and announced an expert review to thoroughly address the security concerns. The company has also confirmed its decision to exit the digital certificate business altogether, signaling a significant shift in its operations following the security scare.

The government has indicated it will conduct a high-level review and audit to assess the full extent of potential damage resulting from this security vulnerability. This incident highlights the critical importance of robust security protocols in the digital certificate ecosystem and the potential ramifications when these fail.