The one-time lapse has taught the community that incidents, even

SENSEX 73,249.39

 -460.30

NIFTY 22,687.65

 -123.70

CRUDEOIL 9,422.00

+ 214.00

GOLD 143,764.00

 -2,315.00

SILVER 201,329.00

 -7,839.00

SENSEX 73,249.39

 -460.30

NIFTY 22,687.65

 -123.70

NIFTY 22,687.65

 -123.70

CRUDEOIL 9,422.00

+ 214.00

CRUDEOIL 9,422.00

+ 214.00

GOLD 143,764.00

 -2,315.00

'; } document.getElementById("lgdv").innerHTML = htmlElements; } function numberformat(i) { return Number(parseFloat(i).toFixed(2)).toLocaleString('en', { minimumFractionDigits: 2 }) } async function gatherResponse(response) { const { headers } = response; const contentType = headers.get('content-type') || ''; if (contentType.includes('application/json')) { return await response.json() } return response.text(); } function getWidth() { if (Math.max(document.body.scrollWidth,document.documentElement.scrollWidth,document.body.offsetWidth,document.documentElement.offsetWidth,document.documentElement.clientWidth) > 991) { document.getElementById("mob").style.display = "none"; document.getElementById("lgdv").style.display = "block"; } else { document.getElementById("mob").style.display = "block"; document.getElementById("lgdv").style.display = "none"; } } getWidth(); THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.

Srinivasan termed it a ‘one-time-one-client’ incident, adding that the weak keys were missed despite maker-checkers in place 

By Akshata GordeVallari Sanzgiri

Updated - October 22, 2026 at 08:14 PM.

eMudhra co-founder Kaushik Srinivasan

Reiterating no compromised infrastructure or data breaches, eMudhra co-founder Kaushik Srinivasan shared his views with businessline on the lessons learnt with the discovery of the process gaps and the measures required to correct the path going forward. While the Board on Thursday decided the company will exit the seucirty certificate business, Srinivasan shared details from the ongoing root-cause analysis and the need for a Human+AI loop.

Edited excerpts:

As per your internal checks so far, what led to the lapses?

We generally keep doing key-generation ceremonies to create issuing CAs for generating certificates. In the specific event on April 30, 2025, there was more or less a script error that triggered the creation of these weak keys. But there were no certificates issued as the issuing CAs never went into production. This has also been assessed not only by us, but by the browsers and the external ecosystem, and there was pretty much no damage done.

This is not a question of infrastructure breach, data breach, or physical or logical control breach. Neither does it have any impact on any of our other operations. It got thrown out of proportion on social media and attracted a lot of scrutiny. It was a script error that happened on that specific day, and it could happen to anybody in the software industry. 

Why were no certificates issued in the 18 months since?

No certificates were issued because those issuing CA’s never went into production. These issuers were meant for our global operations. Last year there were a number of challenges on the macroeconomic front in terms of hardware supply chain constraints, etc. While these keys were created there was an original set and when we had to export via a wrap-unwrap process, the error keys got generated. By the time the hardware arrived we generated a new set of issuers directly in our global markets and used that to issue certificates. That’s why these issuers specifically never went into production. We have around 30-40 issuers these are only eight of them. This was corroborated by the independent researcher, and with AI tools. 

How is it that even external checks and audits failed to detect these weaknesses in two years?

I don’t know. There is an ecosystem, a process and guidelines. The team that did the process also is highly experienced. This matter is routine. On a specific day, it went wrong. Hindsight has taught us a lesson. We will obviously correct our measures going forward. It’s also a lesson for the community that such incidents, while under the surface, are probably critical.

A script used during a routine key-generation process was not flagged and ran multiple times, resulting in weak keys being generated and published during the wrap-and-unwrap process. External auditors review such procedures under WebTrust criteria, but the issue went undetected for several months. The incident has highlighted the need for stronger controls and serves as a broader lesson for the industry.

What did the independent audits examine?

It is a range of things because it is part of the audit criteria, including controls, processes and disclosure of keys. Remember that these keys have also been publicly disclosed for a fairly long period because, as a matter of process and obligation, we have to report to platforms any issuing CAs we create. The auditors have gone through everything. I don’t want to name the auditors but some of our reports are in public domain. 

Who approved the additional wrap–unwrap steps, and why did the existing controls not catch the resulting weak keys?

Generally, our process is that we create keys locally. In this case, the keys had to be exported for our global operations, which is why we use a wrap-and-unwrap process: a key is created and encrypted, then transported, and then decrypted. So it was not a deviation in the sense of non-compliance with the process. It was a deviation from a regular key-generation ceremony because these two additional methods were introduced. The team at the data centre and in PKI operations carried this out. They have been with us for a long time, and it was approved by the head of PKI operations, who has also been with the company for 15 years. 

You had found errors within a month of making these keys. That problem was resolved. But did you not come across these original keys in that time?

That is regarding a very technical process called you know certificate revocation list. So we had not come across these weak keys at that point in time. Had we come across we would have notified ourselves. It came across to light now. We are where we are. 

Can you assure Indian users that the incident has not affected digital-signature services used for GST filings, income-tax returns and other government services?

The Indian DAC and DAC business run on completely isolated and separate infrastructure. It is nowhere connected to the DLS line of business or infrastructure. On the Indian DAC, we have checked and rechecked, there has been no incident similar to this. We have also been working with the regulators to give them whatever information they need. 

What changes will you make to prevent a recurrence?

Human errors cannot be completely avoided. The company plans to strengthen safeguards by pairing human oversight with AI-driven automation. While maker-checker controls will remain in place, additional AI-based and computational checks will be deployed to identify weaknesses that may not be visible through manual review, helping detect errors before they reach production.

Will you make structural changes to the process, and when will these be announced?

Of course. We need to understand that, while there were process gaps, the media and social-media reaction has been significant. We are holding a board meeting today to understand and communicate the impact, and we will go by the board’s decision. 

Could the incident affect customers beyond the eight issuers?

The preliminary evidence, corroborated by publicly available Certificate Transparency logs and Mozilla’s findings, suggests that around 30,000 certificates relate to a single affected US customer. The company maintains that the rest of the world was not impacted, while certificates linked to the affected root are being transitioned to an alternative route. For the eight issuers in question, no customer certificates were ever issued. A final assessment is expected after an additional 24 to 48 hours of verification.

Is the US customer considering legal action? How are you helping it manage the issue, and have other customers taken precautionary steps?

We are trying to address their perception concerns. They use our front-end platform as well as the back-end certificate engine. If some members of their community have perception concerns, we are working with partners to transition them. So far, no other customers have taken precautionary measures that we know of. We have spoken to most of our critical customers directly, one on one. 

How are you addressing concerns of non-browser enterprise clients?

The non-browser advisory has gone out from all of these parties. We have also been speaking to our customers. They have written back to ask which root is involved, and we have clarified that we have not issued any certificates from the affected issuers. We have anyway revoked those roots. The chain of trust automatically gets broken, so there should be no impact. 

What are you doing to address concerns raised by Google, Apple and other browser platforms?

Google, Apple and other browser platforms are currently focused on incident response, with the company responding diligently to their queries. It is also working closely with its largest affected US customer to address concerns, retain confidence, and offer alternative pathways where needed. For enterprise customers, the company is explaining the impact and reassuring them that no damage has occurred to their systems.. 

Do you see concern among clients about the incident and its potential effect on India’s digital-technology reputation?

Client sentiment is already reflected in the stock price. While the response from clients and customers remains to be seen, there is no expectation that the incident will dent India’s reputation as a digital technology hub. Clients have been supportive, and the key takeaway is the need for tighter controls and stronger cybersecurity practices. The incident also highlights the complexity of the technology landscape and the importance of better security awareness and preparedness.

Read: PHP security flaws put 70% of the internet at risk, says Wiz

More Like This

Cyberattack on eMudhra’s digital certificate system? No... It’s something worseeMudhra’s flawed certificate triggers CERT-In probe and raises questions on digital trusteMudhra shares crash 20% to 52-week low after govt orders security probeMeitY says eMudhra security incident had limited impact on Indian websites, probe underwayeMudhra flags weak keys in eight certificate authorities, rules out data breach

Published on October 22, 2026

THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.Sign into Unlock benefits!

• Access 10 free stories per month
• Get notified by email for early preview to new features, discounts & offers