eMudhra investigates predictable keys used in trusted certificates

eMudhra has defended its use of easily guessed private keys to sign some digital certificates, saying a flaw in its key-generation process produced weak keys alongside strong ones. Because the keys could be deduced, attackers could potentially forge certificates and impersonate websites or other services, creating risks for organisations and users that trust them.

The company says the keys were generated on 30 April 2025 using certified hardware security modules, and that the weak keys were published to browser root stores. It says the certificates had passed independent audits for two consecutive years and had been included in browser trust lists since mid-2025, while it investigates the cause and works with affected customers on replacements. eMudhra says TLS accounts for about one per cent of its revenue, but replacing certificates could still be urgent and costly for customers.