eMudhra says select TLS certificates are distrusted after key-generation flaw

eMudhra said some of its global TLS intermediate certificate authorities have been distrusted after a flaw in a 2025 key-generation ceremony produced weak keys that could be reverse-engineered. The company said its India DSC and eSign businesses are unaffected, with no infrastructure compromise or data breach.

Why it matters: - The distrust affects a small slice of eMudhra’s global TLS business, but it could disrupt customer websites and services that rely on those certificates. - eMudhra said the incident creates reputational risk, even though the affected business accounts for about 1% of revenue. - The company said India’s Digital Signature Certificate and eSign businesses are separate and continue to run normally.

What happened: - eMudhra issued a statement on October 21, 2026, about reports that some of its intermediate Certificate Authorities used in global TLS were distrusted. - The issue involves 8 of eMudhra’s intermediate CAs that were trusted for its global TLS business. - The issuing CAs were created under eMudhra’s ECC root during a key-generation ceremony on April 30, 2025. - The ceremony used FIPS 140-2 Level 3 Hardware Security Modules. - A flaw in the key-generation process caused a wrap/unwrap step to generate a second set of weak keys alongside the original strong keys. - The weak keys were the ones published to browser root stores. - An independent researcher found last weekend that the weak keys could possibly be reverse-engineered with AI-assisted techniques. - The researcher reported the issue to Apple, Google, Microsoft and Mozilla.

The details: - eMudhra said the affected roots and issuing CAs had passed independent audits for two consecutive years. - The certificates had been on browser trust lists since mid-2025. - eMudhra is still working to establish the root cause of the flaw. - The company said its infrastructure was not compromised. - The company said no data was breached. - The company said all physical and logical security controls remained intact. - The global TLS business runs on infrastructure that is completely separate from the India DSC business. - DSC and eSign services in India are operating normally. - eMudhra said the affected global TLS business represents around 1% of company revenue.

Between the lines: - The event appears to be a certificate trust and key-management failure, not a broader cyberattack. - Because the weakness was tied to published browser-trusted keys, remediation depends on coordination with root programs and customer certificate replacement. - The fact that the researcher involved major browser vendors suggests the trust impact could move quickly across the ecosystem.

What's next: - eMudhra is working directly with potentially affected customers to provide replacement certificates. - The company is continuing its root-cause investigation. - eMudhra is also coordinating with the root programs involved in browser trust decisions. - Customers with affected certificates may need replacements to avoid service disruption.

The bottom line: - eMudhra says the issue is limited to a small part of its global TLS operation, with no breach or infrastructure compromise, but browser distrust means the company still faces operational and reputational fallout.