Google, Apple, Microsoft and Mozilla All Cut Off Indian Firm eMudhra Over a Shockingly Simple Mistake

Mozilla, Google, Apple and Microsoft have blocked eight security certificates issued by Bengaluru-based eMudhra after researchers found the secret keys behind them were weak enough to crack almost instantly. One of those keys was the number 4.

Here is what it means in simple words - when you open a website with HTTPS, your browser checks a digital certificate to confirm the site is genuine. Companies called certificate authorities issue these certificates, and eMudhra is one of them. With the compromised keys, an attacker could issue fake HTTPS certificates for websites they don't control. Someone who could also intercept your connection could then pose as a real site and read or change what you send.

How weak were the keys?

A key of this type should be a random 384-bit number, which works out to roughly a 116-digit number. That leaves far too many options for anyone to ever guess. According to Mozilla's incident report, all eight eMudhra keys, generated in April 2025, were smaller than 256. Anyone could recover them by trying just 256 numbers.

Security researcher Scott Helme found one key was the number 4, and other researchers found keys as small as 66 and 155. He also said a simple prompt to an AI agent was enough to recover them.

eMudhra's explanation is a bug in the script used during its key generation ceremony. That bug created a second, weak key pair on the secure hardware, and because the two had similar names, staff used the wrong keys by mistake.

Browsers moved within hours

A researcher known only as Wayne found the flaw on October 17 while scanning public certificate data. He reported it to Apple, Google, Microsoft, Mozilla and eMudhra that day. Mozilla blocked the certificates in Firefox in under three hours, and since the fix ships through a background list, users didn't need to update or restart.

Chrome followed the same day, Apple on October 19 and Microsoft on October 20. Mozilla also released Firefox 158.0.1 for users whose settings blocked the background update. eMudhra has revoked all eight certificates and stopped issuing new ones under the affected root, and Google is removing that root from Chrome.

Is your digital signature safe?

This is the part most Indian users will care about. Millions of people use eMudhra digital signature certificates for income tax, MCA filings and tenders. The company says its Indian DSC and eSign businesses run on completely separate infrastructure and are not affected. eMudhra also says its root keys and other intermediate certificates are safe, and that only one of the eight affected certificates was in active use.

The company puts the business impact at about 1% of revenue. Investors weren't convinced, and eMudhra shares fell 18% in early trading on the NSE on Wednesday.

What you should do

If your browser is up to date, you are already protected. The bigger risk sits with older apps and software that don't check whether a certificate has been revoked. Developers and IT teams can check their systems at emudhra.we-have-a-problem.com, where a certificate error means the client is protected.