India’s cybersecurity ecosystem faces a historic trust crisis as global tech titans—including Google, Microsoft, Apple, and Mozilla—officially revoked trust in multiple intermediate certificate authorities operated by eMudhra, following the discovery of critically flawed, single-byte private cryptographic keys.
The security failure traces back to an April 2025 key generation event, where a software script error stripped away cryptographic randomness. Instead of complex 384-bit strings, the system generated basic single-byte integers like 4, 66, and 237. Security researchers successfully reverse-engineered these keys in under a second.
India's national cyber agency, CERT-In, issued an urgent advisory detailing mitigation protocols. Market reaction was immediate; eMudhra’s stock plunged 20%, hitting its lower circuit limit on the National Stock Exchange.
In a regulatory filing, eMudhra stated the issue is confined strictly to its global TLS business, which represents roughly 1% of its revenue, assuring stakeholders that its core domestic Digital Signature Certificate (DSC) infrastructure remains fully secure.
Cloudflare, which rushed out global patches, warned: "While there is no active evidence of exploitation, the absolute mathematical simplicity of this flaw bypasses standard internet security barriers." Devices must update immediately to ensure automated rejection of the compromised certificates.