A private key is supposed to be unguessable: a number with roughly 115 digits of randomness standing between the ordinary internet and anyone wishing to impersonate it. At eMudhra Limited, a Bengaluru-based certifying authority licensed by India's government, eight such keys turned out to be small enough to find by trial and error within seconds. One of them was simply the number 4. The discovery, reported to browser makers on 17 October 2026, has forced the company to revoke all eight certificates, drawn a swift response from the world's major browser vendors, and prompted calls for a formal inquiry into how a licensed authority could have made so basic an error.
A foundational failure in digital trust
Certificate authorities exist to vouch for identity online. When a browser confirms a secure connection, it is relying on a signature that only the certificate authority's private key could have produced. If that key can be worked out, anyone can forge a certificate for any website and intercept traffic on an unsuspecting network. eMudhra says the eight keys were generated at a single ceremony in April 2025, using hardware meant to produce cryptographically strong randomness, but that a flawed script and mislabelling meant weak, duplicate keys were used instead of the intended ones. The company's own account, posted to Mozilla's public bug tracker, describes "human errors in multiple steps of the process" - a troubling admission from an organisation whose entire business rests on procedural rigour.
A warning that went unheeded
What makes this episode more serious than a one-off technical slip is the evidence of an earlier signal. Records show that in May 2025, eMudhra issued revocation lists for the same six website-facing certificates using signatures that turned out to be invalid - and rather than investigating why, the company resigned them with what are now known to be the flawed keys. That earlier anomaly, if examined properly at the time, might have exposed the problem eighteen months before outside researchers did. Browser makers acted fast once alerted: Chrome, Firefox, Apple and Microsoft blocked the certificates within three days, and eMudhra revoked them on 18 October. But browsers are only part of the picture. A great deal of software outside the browser - embedded systems, internal corporate tools, older applications - does not check revocation status at all, and remains exposed until it is patched or updated, if it ever is.
Why disclosure and oversight now matter
eMudhra maintains that only one of the eight certificate authorities was ever put into production, that none issued fraudulent certificates, and that its India-facing digital signature and eSign services were unaffected. Those assurances rely on logs and internal review rather than independent verification. CERT-In, India's cybersecurity response agency, issued an advisory on 21 October, but no statement has been found from the Controller of Certifying Authorities, the body within the Ministry of Electronics and Information Technology that licenses eMudhra and bears responsibility for the integrity of India's digital signature infrastructure. That silence is why representations have now been sent to eMudhra, CERT-In and the Ministry, calling for a full incident report, an independent technical audit of eMudhra's key-generation practices, fuller public disclosure from CERT-In, and a regulatory inquiry into how a licensed authority operated for roughly eighteen months with keys that offered no real protection at all. Given how much of India's digital signature and eSign ecosystem depends on this single licensed authority, the public interest in a transparent, independent accounting goes well beyond the technical community that first spotted the flaw.