eMudhra faces a bigger test of public trust

The company has voluntarily exited from the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business following the incident.

This week, eMudhra withdrew from its global website certificate business after an anonymous researcher named “Wayne” flagged weak private keys associated with eight certificate authorities (CAs) and browsers such as Google Chrome and Mozilla Firefox blocked them.

The weakness survived about 18 months and two external audit cycles before “Wayne” alerted the company and browser operators.

The voluntary exit from the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business leaves a larger question for eMudhra on trust, and goes beyond the division it is winding down.

In an interview with ET AI, co-founder Kaushik Srinivasan said the affected business accounted for 1% of the revenue but acknowledged a script error and human oversight had produced weak cryptographic keys.

He claimed no customer data suffered a breach and Indian digital-signature and eSign services remained unaffected.

Srinivasan traced the problem to a key-generation ceremony on April 30, 2025, a controlled process for creating the mathematical keys used by certificate authorities. The company added an export step as it prepared infrastructure for its North America operations, he said.

“As part of the export process, a script error, coupled with human oversight, resulted in issuing CAs with weak keys. The keys themselves conformed to policy, but their strength was weak,” Srinivasan clarified.

Mozilla warned attackers who recovered those keys could potentially impersonate websites on software that still trusted them and read or alter traffic if they could intercept a user’s connection.

Srinivasan said the company followed its usual access and authorisation controls, but needed additional computational checks to identify the weakness.

“Additional scripts would have had to be run and that is how we would have detected it. That is probably where the oversight was, on our part. Of course, the certificates had also been in the public domain for a long time. That is really what happened,” he said.

Srinivasan said the board decided to exit the business after reviewing competition and expected returns on investment and not because browsers were about to stop trusting its certificates. He claimed the browsers continued to trust the company’s G1 root.

G1 root, short for “generation one”, is eMudhra’s first master certificate that browsers trust to verify the website security certificates it issues.

“The main deliberation the board had was that this incident brought about a disproportionate amount of kind of scrutiny for a fairly small line of business,” Srinivasan said.

He added the question was what return on investment is possible, given where the industry is headed.

“The board, therefore, deliberated and decided it was probably prudent to exit this business and focus on our core enterprise business, which has high margins. The focus is on expanding that business and our India solutions business, which is growing. That was the rationale. It was not a consequence of us being about to be distrusted,” he clarified.

Srinivasan said the Indian signing services operate on a separate infrastructure and the company had spoken individually with key customers about their operations. It plans an independent review beyond the specific incident.

“We will appoint an independent auditor to do two things. One is to examine the incident, assess what happened and review our processes, procedures and the records we have. The other is to review our entire cryptographic estate and provide an assessment,” Srinivasan explained.

He said the report will be live on the public domain. “That is our commitment. Hopefully, this will help us restore some level of trust with our customers.”

Separately, credit rating agency ICRA kept eMudhra’s ratings unchanged in an October 23 update, noting the company’s decision to exit the global website certificate business and its limited contribution to revenue.

Beyond the review, Srinivasan said AI was changing how attackers find weaknesses, making continuous security checks more important for companies like eMudhra.

“What happened to us can happen to anybody. AI is changing how attackers look at things. They can now generate various attack vectors and the attack surface is increasing. People can probably get hold of hacking scripts more easily,” he said.

He suggested using AI to check digital keys from the time they are created until they are no longer used, backed by independent audits and internal security tests.

“Continuous threat assessment is the way forward. With AI, you can verify what you do on an ongoing basis. AI can be built into every process, whether it is a key-generation ceremony, key creation, usage or validation,” Srinivasan said.