eMudhra Revokes 8 More Digital Certificate Authorities After Faulty Python Script Creates Weak Keys
A major cybersecurity investigation has revealed how a tiny coding mistake inside an Indian digital trust company created one of the weakest encryption keys ever seen in modern internet history. Digital certificate provider eMudhra has officially confirmed that a faulty in house Python script accidentally cut eight of its private encryption keys down to a single byte. Because of this bug, one of those secret digital keys ended up being just the number 4, a value so simple that an attacker could guess it almost instantly using basic public information.
To understand why this mistake matters so much to everyday internet users, it helps to look at how website security works. When you open your bank website or shop online, your web browser checks a digital pass called a certificate to make sure the site is genuine and not a fake copy run by criminals. Companies like eMudhra act as trusted digital guards, known as certificate authorities, that sign these passes using long, complex secret keys. Normally, guessing a secret key takes trillions upon trillions of years, making it impossible for hackers to forge fake website passes.
However, during an internal setup event on April 30, 2025, eMudhra used a custom Python program to move secret keys between special high security hardware boxes. According to details shared by the company on Mozilla's public bug tracker, one line in that script mistakenly sliced the secret key value down to just its very first byte. Instead of creating an unbreakable digital lock, the flawed script produced keys that had only two hundred and fifty six possible values, with the weakest key turning out to be the single digit 4.
What makes this situation even more concerning is that the broken keys still managed to pass standard automated checks and two outside security audits without raising any alarms. The problem stayed hidden for over a year until October 2026, when an independent security researcher using the name Wayne discovered the flaw while testing public certificate data. Wayne realized the keys were dangerously short and immediately alerted major browser makers, forcing companies like Google, Mozilla, Apple, and Microsoft to rush out emergency blocks to protect internet users.
In its newest update, eMudhra also reversed an earlier statement regarding a second group of digital certificates. When the trouble first came to light, the company told browser makers that eight other RSA certificate authorities were completely safe because they followed a different path. Now, after digging deeper into its records, eMudhra admitted that those eight authorities went through the exact same flawed script step where secret key data was read out into regular computer memory.
Even though those eight RSA keys were not shortened like the first batch, the company acknowledged it can no longer prove the secret material was handled strictly according to its own safety rules. Because trust in online security depends on following strict procedures without exception, eMudhra revoked all eight of those additional authorities. Six of them were used to secure websites, while two were used to verify software programs, covering a total of one hundred and ninety five active certificates used by universities, local government offices, and eMudhra's own web domains.
For an independent observer watching the global technology sector, this incident shows how even small shortcuts in software code can shake worldwide internet trust. Security hardware boxes are built specifically so that secret keys never leave the safe device. Writing a quick script to pull keys out of hardware into normal computer memory defeated the entire purpose of that protection, turning a routine hardware upgrade into a global security headache.
The investigation also uncovered a missed warning sign that happened months before the public discovery. In June 2025, staff members noticed that certain revoked certificate lists had been signed with mismatched keys. Instead of stopping to investigate why the keys did not match, the team simply re signed the lists with the right keys and moved on. Looking back, eMudhra admitted that this early error was a clear clue that its key handling process had gone wrong.
In response to the mounting scrutiny from global technology leaders, eMudhra has announced that it is shutting down its publicly trusted website certificate business altogether. The company will instead focus on its domestic digital signature and identity services inside India. Major tech companies have already laid out a strict timeline to remove remaining trust in eMudhra's global certificates between November 16 and November 30, 2026.
While eMudhra stated that it has found no signs that hackers abused the weak keys to spy on users or fake websites, the cleanup is still underway. The company confirmed that all affected customers have already been moved over to safe replacement certificates. Meanwhile, global accounting and advisory firm KPMG has been brought in to conduct a full independent review of the company's security practices, with its final report scheduled for release on December 4, 2026.