eMudhra certificate keys leak; shares crash 20% after CERT-In advisory

Eight eMudhra web security keys have leaked after a basic crypto flaw -- keys used numbers 1-256 instead of a 384-bit private key. Shares crashed 20% as CERT-In issued an advisory; browser makers are scrambling to patch.

Eight private keys used by Bengaluru-headquartered eMudhra Ltd to issue web security certificates have leaked, after an anonymous researcher found that its intermediate certificates used a trivially weak numerical key between 1 and 256 instead of a proper 384-bit private key. The incident has sent browser and operating-system makers scrambling to patch systems and stop trusting affected certificates.

The breach matters because eMudhra is the sole Indian root certificate authority trusted globally, and many government websites -- including the Aadhaar issuer UIDAI and the Income Tax filing portal -- use its certificates or related technology. eMudhra said none of the affected intermediate authorities were deployed in production except one, and revoked the affected certificates in response.

The fallout has been swift: the Indian Computer Emergency Response Team issued an advisory, and the company's shares plunged 20 per cent, taking two-session losses to 36 per cent. Security experts warned that even after browser patches, IoT devices that are rarely updated could remain exposed, calling the cleanup effort enormous.