Bengaluru: Eight private keys used by Bengaluru-based eMudhra Ltd. to issue web security certificates have been leaked. Security teams at major browser and operating system companies around the world are now rushing to stop trusting the affected certificates.
Many Indian government websites, including the Aadhaar issuer UIDAI and the income tax filing portal, use certificates or other technology from the company. There is no sign so far that eMudhra’s main root certificates have been compromised.
What Went Wrong
When you open a website and see a padlock icon, a security certificate is working in the background. It proves the site is genuine and keeps your data private. These certificates depend on a private key, a secret code that nobody else should ever know.
An anonymous researcher warned major internet companies about a serious flaw in eMudhra’s “intermediate” certificates. These are middle-level certificates that sit between the main root certificate and the ones websites actually use. Instead of a strong 384-bit key, they used a tiny number between 1 and 256. That made the keys far easier to guess. One key was simply the number 4, written after 383 zeroes.
Dennis Jackson, who was involved in Mozilla’s response, said the keys were “trivial to exploit.” He added that six of the affected certificates are for TLS, the technology that secures websites, and are trusted by the Chrome, Mozilla, Microsoft and Apple root programs.
eMudhra’s Response
eMudhra has revoked the affected certificates. In an update on its website, the company said it began its incident response procedures and is working with browser and root-store operators to protect users.
The company said none of the affected intermediate certificates were in use, except one, which it did not name. It also said none of them, including that one, had issued any certificates to websites or users. According to eMudhra, its internal analysis and public Certificate Transparency records confirm this.
In a separate filing to the stock exchanges, the company explained that a flaw in its Key Generation Ceremony caused a step in the process to create a second set of weak keys alongside the original strong ones. The weak keys were the ones submitted to browser root stores. eMudhra says it is still working to find the root cause.
Why It Matters
Cybersecurity expert Yash Kakadia, founder of the firm Security Brigade, warned that the effects could go beyond browsers. Smart devices, known as Internet of Things (IoT) devices, are often not updated regularly. “The cleanup could be enormous,” he said, especially for devices and software that cannot be easily updated.
The incident also matters because of India’s history with global browsers. Browsers have been cautious about trusting Indian root certificate authorities since “rogue” certificates were issued in July 2014 by the National Informatics Centre’s root authority. eMudhra is currently the only Indian root authority trusted worldwide.
In 2023, the Ministry of Electronics and Information Technology (MeitY) launched the Indian Web Browser Development Challenge to build an Indian browser that would trust root authorities approved by the Controller of Certifying Authorities (CCA). Zoho Corp’s browser Ulaa won the challenge and the ₹1 crore prize.
