Last week, eMudhra—an Indian digital certificate authority—sparked widespread concern across the cybersecurity sector after a major flaw emerged in its certificate private key management. Specifically, the private keys for eight intermediate CA certificates issued by the company were found to be critically insecure. The private key for the EM OV TLS CA-G3C certificate, for instance, was as simple as the number "4." This glaring vulnerability allowed malicious actors to exploit the certificate and issue forged sub-certificates for other domain names, posing a significant threat to global internet security.

The root cause of this incident traced back to a key generation error in April 2025. During this period, the company inadvertently produced private keys of extremely low complexity, such as the number "4" or other short numeric strings. These weak keys could be easily derived by attackers, enabling them to forge certificates with relative ease.

In response, major browser vendors—including Google, Apple, Microsoft, and Mozilla—swiftly took action. They revoked trust in the affected certificates and rolled out updates to block any certificates generated with these weak keys, thereby mitigating the potential risks to users.

eMudhra acknowledged the flaws in its key generation process, attributing them to both technical oversights and human errors. As a result, the company announced its decision to withdraw from the global SSL/TLS certificate business altogether. This incident serves as a stark reminder of the critical importance of robust security measures within certificate authorities. Weak private keys can pave the way for large-scale certificate forgery attacks, causing irreparable damage to corporate reputations and eroding user trust in digital security infrastructure.