EMudhra
Indian information security company
From Wikipedia, the free encyclopedia
eMudhra Limited is an Indian company founded in 2008 that provides public key infrastructure services. It says it has issued more than 60 million digital certificates.[2] In October 2026, the private keys of eight of its intermediate certificates were found to be extremely weak, leading browser vendors to block the certificates and Mozilla to remove the root certificate that issued them from its trust store.
| eMudhra Limited | |
|---|---|
.svg) | |
| Type | Public |
| NSE: EMUDHRA | |
| Industry | Certificate authority |
| Founded | 2008 |
| Headquarters | Bengaluru, Karnataka, India |
| Key people |
|
| Website | emudhradigital |
.svg)
History
In 2026, eMudhra began a partnership with LankaSign.[3]
2026 intermediate certificate compromise
On October 17, 2026, browser root programs received a report that the private keys of eight eMudhra intermediate certificates had been compromised.[4]
The private keys were 4, 56, 66, 115, 155, 156, 230 and 237.[5] A P-384 elliptic-curve private key normally has about 384 bits of entropy, but these keys had between 3 and 8 bits.[5] Security researcher Scott Helme said he had recovered several of the keys from the certificates' public keys in less than a second.[2] Because the keys could be recovered from the public certificates, anyone could have used them to issue certificates for any website that browsers would trust.[5][2] As of October 20, 2026[update], the cause of the weak keys had not been determined.
Google Chrome and Firefox blocked the certificates within hours of the report. Apple followed on October 19 and Microsoft on October 20.[4] eMudhra revoked the eight certificates.[2] On October 20, Mozilla removed the root certificate that had issued them, emSign ECC Root CA – G3, from NSS, and Google said Chrome would also remove it.[4] As of that date, there were no reports in Certificate Transparency logs of the keys being used maliciously.[5] The cleanup was expected to take a long time, because many Linux distributions, embedded devices and applications ship their own copies of root certificates.[5]
