Eight private keys used by Bengaluru-based eMudhra Ltd. to secure web certificates have been leaked. These keys are crucial for issuing security certificates that many government websites rely on to function properly in modern browsers.
A researcher discovered a major flaw: instead of using strong 384-bit private keys, the affected certificates used numerical keys between 1 and 256. This made them much easier to guess or crack. For example, one key was simply the number “4.” Such weak security is dangerous because public key systems depend on keeping private keys secret.
Major browsers like Chrome, Mozilla Firefox, Microsoft Edge, and Apple Safari use these certificates to trust websites. Dennis Jackson from Mozilla said the compromised keys could affect millions of users. eMudhra revoked the affected certificates and worked with browser developers to fix the issue.
eMudhra stated that none of the leaked certificates were actively used in production except for one. They also confirmed no end-user certificates were issued using these keys, which might have worsened the impact.
Yash Kadakia from Security Brigade warned that older devices like IoT gadgets may still be at risk since they are often not updated regularly.
Many government services, such as Aadhaar and income tax portals, use eMudhra’s security certificates. The Hindu reached out to India’s electronics ministry for comment but hasn’t received a response yet.
Importantly, the root certificates controlled by eMudhra—which sit above the compromised ones—appear secure. However, Indian root certificate authorities have faced trust issues globally since 2014 when rogue certificates were issued. eMudhra remains the only Indian authority trusted worldwide.
In 2023, India’s electronics ministry promoted a challenge to develop an indigenous web browser that would trust local certificate authorities. Zoho’s Ulaa won this competition.