{"slug": "emudhra-faces-a-bigger-test-of-public-trust-after-security-lapse", "title": "eMudhra faces a bigger test of public trust after security lapse", "summary": "EMudhra is exiting the global SSL/TLS certificate business after a weak-key flaw in certificates issued from a key-generation ceremony on April 30, 2025 survived roughly 18 months and two external audit cycles before a researcher named \"Wayne\" alerted the company and browser operators, co-founder Srinivasan told ET AI. Srinivasan said a script error plus human oversight during an export step for North America infrastructure produced issuing CAs with keys that conformed to policy but were weak, and that no customer data was breached and Indian digital-signature and eSign services were unaffected. eMudhra will appoint an independent auditor to examine the incident and review its entire cryptographic estate, with the report to be published publicly, while Srinivasan said the board exited the business over competition and returns rather than imminent distrust of its G1 root.", "body_md": "Listen to this article in summarized format\n\nThis week, \n\nThe weakness survived about 18 months and two external audit cycles before “Wayne” alerted the company and browser operators.\n\nThe voluntary exit from the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business leaves a larger question for\n\nIn an interview with ET AI, co-founder\n\nHe claimed no customer data suffered a breach and Indian digital-signature and eSign services remained unaffected.\n\nSrinivasan traced the problem to a key-generation ceremony on April 30, 2025, a controlled process for creating the mathematical keys used by certificate authorities. The company added an export step as it prepared infrastructure for its North America operations, he said.\n\n“As part of the export process, a script error, coupled with human oversight, resulted in issuing CAs with weak keys. The keys themselves conformed to policy, but their strength was weak,” Srinivasan clarified.\n\nMozilla warned attackers who recovered those keys could potentially impersonate websites on software that still trusted them and read or alter traffic if they could intercept a user’s connection.\n\nSrinivasan said the company followed its usual access and authorisation controls, but needed additional computational checks to identify the weakness.\n\n“Additional scripts would have had to be run and that is how we would have detected it. That is probably where the oversight was, on our part. Of course, the certificates had also been in the public domain for a long time. That is really what happened,” he said.\n\nSrinivasan said the board decided to exit the business after reviewing competition and expected returns on investment and not because browsers were about to stop trusting its certificates. He claimed the browsers continued to trust the company’s G1 root.\n\nG1 root, short for “generation one”, is eMudhra’s first master certificate that browsers trust to verify the website security certificates it issues.\n\n“The main deliberation the board had was that this incident brought about a disproportionate amount of kind of scrutiny for a fairly small line of business,” Srinivasan said.\n\nHe added the question was what return on investment is possible, given where the industry is headed.\n\n“The board, therefore, deliberated and decided it was probably prudent to exit this business and focus on our core enterprise business, which has high margins. The focus is on expanding that business and our India solutions business, which is growing. That was the rationale. It was not a consequence of us being about to be distrusted,” he clarified.\n\nSrinivasan said the Indian signing services operate on a separate infrastructure and the company had spoken individually with key customers about their operations. It plans an independent review beyond the specific incident.\n\n“We will appoint an independent auditor to do two things. One is to examine the incident, assess what happened and review our processes, procedures and the records we have. The other is to review our entire cryptographic estate and provide an assessment,” Srinivasan explained.\n\nHe said the report will be live on the public domain. “That is our commitment. Hopefully, this will help us restore some level of trust with our customers.”\n\nSeparately, credit rating agency\n\nBeyond the review, Srinivasan said AI was changing how attackers find weaknesses, making continuous security checks more important for companies like eMudhra.\n\n“What happened to us can happen to anybody. AI is changing how attackers look at things. They can now generate various attack vectors and the attack surface is increasing. People can probably get hold of hacking scripts more easily,” he said.\n\nHe suggested using AI to check digital keys from the time they are created until they are no longer used, backed by independent audits and internal security tests.\n\n“Continuous threat assessment is the way forward. With AI, you can verify what you do on an ongoing basis. AI can be built into every process, whether it is a key-generation ceremony, key creation, usage or validation,” Srinivasan said.\n\n[eMudhra](https://economictimes.indiatimes.com/emudhra-ltd/stocks/companyid-2043301.cms)withdrew from its global website certificate business after an anonymous researcher named “Wayne” flagged weak private keys associated with eight certificate authorities (CAs) and browsers such as Google Chrome and Mozilla Firefox blocked them.\nThe weakness survived about 18 months and two external audit cycles before “Wayne” alerted the company and browser operators.\n\nThe voluntary exit from the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business leaves a larger question for\n\n[eMudhra](https://economictimes.indiatimes.com/topic/emudhra)on trust, and goes beyond the division it is winding down.\nIn an interview with ET AI, co-founder\n\n[Kaushik Srinivasan](https://economictimes.indiatimes.com/topic/kaushik-srinivasan)said the affected business accounted for 1% of the revenue but acknowledged a script error and human oversight had produced weak cryptographic keys.\nHe claimed no customer data suffered a breach and Indian digital-signature and eSign services remained unaffected.\n\n**Slipping through the cracks**\nSrinivasan traced the problem to a key-generation ceremony on April 30, 2025, a controlled process for creating the mathematical keys used by certificate authorities. The company added an export step as it prepared infrastructure for its North America operations, he said.\n\n“As part of the export process, a script error, coupled with human oversight, resulted in issuing CAs with weak keys. The keys themselves conformed to policy, but their strength was weak,” Srinivasan clarified.\n\nMozilla warned attackers who recovered those keys could potentially impersonate websites on software that still trusted them and read or alter traffic if they could intercept a user’s connection.\n\nSrinivasan said the company followed its usual access and authorisation controls, but needed additional computational checks to identify the weakness.\n\n“Additional scripts would have had to be run and that is how we would have detected it. That is probably where the oversight was, on our part. Of course, the certificates had also been in the public domain for a long time. That is really what happened,” he said.\n\n**Rebuilding confidence**\nSrinivasan said the board decided to exit the business after reviewing competition and expected returns on investment and not because browsers were about to stop trusting its certificates. He claimed the browsers continued to trust the company’s G1 root.\n\nG1 root, short for “generation one”, is eMudhra’s first master certificate that browsers trust to verify the website security certificates it issues.\n\n“The main deliberation the board had was that this incident brought about a disproportionate amount of kind of scrutiny for a fairly small line of business,” Srinivasan said.\n\nHe added the question was what return on investment is possible, given where the industry is headed.\n\n“The board, therefore, deliberated and decided it was probably prudent to exit this business and focus on our core enterprise business, which has high margins. The focus is on expanding that business and our India solutions business, which is growing. That was the rationale. It was not a consequence of us being about to be distrusted,” he clarified.\n\nSrinivasan said the Indian signing services operate on a separate infrastructure and the company had spoken individually with key customers about their operations. It plans an independent review beyond the specific incident.\n\n“We will appoint an independent auditor to do two things. One is to examine the incident, assess what happened and review our processes, procedures and the records we have. The other is to review our entire cryptographic estate and provide an assessment,” Srinivasan explained.\n\nHe said the report will be live on the public domain. “That is our commitment. Hopefully, this will help us restore some level of trust with our customers.”\n\nSeparately, credit rating agency\n\n[ICRA](https://economictimes.indiatimes.com/icra-ltd/stocks/companyid-1311.cms)kept eMudhra’s ratings unchanged in an October 23 update, noting the company’s decision to exit the global website certificate business and its limited contribution to revenue.**AI and the security challenge**\nBeyond the review, Srinivasan said AI was changing how attackers find weaknesses, making continuous security checks more important for companies like eMudhra.\n\n“What happened to us can happen to anybody. AI is changing how attackers look at things. They can now generate various attack vectors and the attack surface is increasing. People can probably get hold of hacking scripts more easily,” he said.\n\nHe suggested using AI to check digital keys from the time they are created until they are no longer used, backed by independent audits and internal security tests.\n\n“Continuous threat assessment is the way forward. With AI, you can verify what you do on an ongoing basis. AI can be built into every process, whether it is a key-generation ceremony, key creation, usage or validation,” Srinivasan said.", "url": "https://wpnews.pro/news/emudhra-faces-a-bigger-test-of-public-trust-after-security-lapse", "canonical_source": "https://economictimes.indiatimes.com/ai/ai-insights/emudhra-faces-a-bigger-test-of-public-trust-after-security-lapse/articleshow/135165282.cms?from=mdr", "published_at": "2026-10-25 05:03:45+00:00", "updated_at": "2026-10-25 05:42:15.914560+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["eMudhra", "Srinivasan", "Mozilla", "ET AI", "G1 root"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/emudhra-faces-a-bigger-test-of-public-trust-after-security-lapse", "markdown": "https://wpnews.pro/news/emudhra-faces-a-bigger-test-of-public-trust-after-security-lapse.md", "text": "https://wpnews.pro/news/emudhra-faces-a-bigger-test-of-public-trust-after-security-lapse.txt", "jsonld": "https://wpnews.pro/news/emudhra-faces-a-bigger-test-of-public-trust-after-security-lapse.jsonld"}}