Coding Error Turns eMudhra Cryptographic Keys Dangerously Weak

A single coding error in a custom Python script caused digital trust company eMudhra to create private cryptographic keys as weak as the number four. An independent security researcher known as Wayne discovered the issue after reverse-engineering the keys, which resulted in the smallest private key being four and the largest being 237.

The Cause

eMudhra used a Python script written by its own team to wrap and unwrap private keys for secure transport. A bug in this script caused the keys to be read back incorrectly after transport, shortening their values far below the accepted 384-bit strength. The company ran this script during a key generation ceremony on April 30, 2025, to prepare keys for servers in other sites. The script ran on an isolated host and was not a part of the standard emCA software. eMudhra also revoked eight additional RSA key pairs on November 7, 2026, because it could not prove they followed its handling rules.

Industry Impact

eMudhra operates as a certificate authority that vouches for website identities on the internet. Major browser providers like Apple, Google, Microsoft, and Mozilla quickly blocked all eight affected intermediate certificates after Wayne flagged the security risk. Web infrastructure firms, app developers, and security teams rushed to issue updates before malicious actors could exploit the weak keys. Amid mounting online scrutiny, eMudhra announced it is exiting the global digital certificate business to focus on digital signature and authentication services within India. The company has also hired KPMG as an independent reviewer to finish its review by December 4.

Context

Certificate authorities play a vital role in web security by issuing digital certificates that establish trusted connections between users and web servers. When cryptographic keys are severely weakened by software bugs, the underlying trust framework that protects internet traffic can be compromised. Companies in this sector must follow strict operational controls to prevent unauthorized access or key degradation during transport.