Vulnerable keys were created but never put to commercial use, investigation on: eMudhra cofounder

Weak keys were created by eight out of 40 certifying authorities but never put to commercial use, implying there was no cyber security incidence due to vulnerable keys, a senior official of digital certification firm eMudhra said on Wednesday.

eMudhra issues digital signature and website security certificates to enable them securely connect to browsers for public access.

"There's no impact to subscribers because we have done all the actions. We are also working with our customers to notify them that there is no impact because no certificates were issued. This does not affect our other lines of business, which is the India digital signature and our enterprise solutions business," eMudhra co-founder Kaushik Srinivasan told PTI.


He said the keys are manually generated through a process using code for TSL (Transport Layer Security) or SSL (Secure Sockets Layer) certificates. The digital security certificates enable browsers to identify genuine web platforms.

"We are investigating to check what led to the error by CAs (certifying authorities)," Srinivasan said.

Eight of eMudhra's issuing CAs were created with keys that were weaker than they should have been, he said.

The compromised keys could have been used by cyber criminals to develop a fraudulent online platform impersonating any genuine payment entity and lure people to make payments or access their personal information.

Customers often scan QR codes to make payments. The browser connects to a platform for payment that has a security certificate in place otherwise displays warning that the website may be insecure. With access to weak keys, a cyber criminal could have easily created a genuine-looking fraudulent platform which could have dodged security layers of the web browser.

The vulnerability was discovered by a cyber security researchers who shared the findings with Apple, Google, Microsoft and Mozilla that the weak keys could be reverse-engineered possibly with AI-assisted techniques.

eMudhra said that its infrastructure was not compromised, no data was breached, and all physical and logical security controls of the firm remained intact.

The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate the incident at eMudhra.

CERT-In said that the issuance of digital signature certificate and eSign services, regulated by the Controller of Certifying Authorities under Meity are not impacted.

CERT-In said Google has blocked the public keys of the affected TLS intermediates in Chrome through a Certificate Revocation List Set (CRLSet) update.

Google has also announced the removal of emSign ECC Root CA- G3 -- a product of eMudhra, from the Chrome Root Store.

Mozilla blocked the six affected TLS intermediate certificates of eMudhra.

"The affected global TLS business is a very small part of eMudhra's operations and accounts for around 1 per cent of the company's revenue. However, this may have some reputational risks for eMudhra, which cannot be quantified," Srinivasan said.

The incident coincides with the country's largest bank, SBI, disclosing suspected exposure of 3,897 customer records containing personally identifiable information on the dark web, following alerts it received on October 16 from its threat intelligence service provider.

SBI in a regulatory filing said that a preliminary analysis of around 3.75 lakh records available on the dark web identified 3,897 customer records containing sensitive information, including registered mobile numbers, dates of birth, names, gender, email addresses and residential addresses.

The exposed information reportedly also included branch and Customer Information File (CIF) identifiers, lead IDs, and metadata associated with loan and lead records and other related files.

Last week, CERT-In had issued a 'critical' advisory warning that autonomous AI agents have accessed live systems and confidential data of Indian organisations without authorisation.

In its advisory (CIAD-2026-0049) titled 'AI Agents as Attack Vectors', the Indian Computer Emergency Response Team (CERT-In) highlighted two distinct categories of incidents targeting the Information and Communication Technology (ICT) infrastructure of Indian entities.

In the first set of incidents, AI model providers voluntarily disclosed that autonomous AI models and agents undergoing research and evaluation had exceeded the authorised scope of their assigned tasks and reached live systems belonging to Indian organisations.

During these operations, the AI agents read business records containing personal data and confidential material, using credentials and connection settings left exposed in application configurations, public code repositories and overly permissive cloud service roles, the agency noted.