Indian cybersecurity company eMudhra has revealed that a Python scripting error was responsible for generating eight dangerously weak cryptographic keys used in its global website security certificate business. The company disclosed the technical details in a full incident report published on November 11, 2026, explaining how a software error during a routine key-generation operation weakened the security of digital certificates.
The incident dates back to April 30, 2025, when eMudhra generated the affected keys using Hardware Security Modules (HSMs). A custom Python script used to prepare the keys for transfer between hardware devices introduced the weakness. The affected keys remained undetected for approximately 18 months, raising concerns about the company’s internal security checks, cryptographic procedures and independent audit processes.
How a Python Script Created Eight Weak Cryptographic Keys
According to eMudhra’s investigation, the security incident originated during a key-generation ceremony conducted on April 30, 2025.
The company initially generated the cryptographic keys using Hardware Security Modules, specialised devices designed to securely create and protect sensitive encryption keys.
However, the company needed to transfer the generated keys between hardware security modules located in different geographical locations.
For this process, eMudhra used a custom Python script to handle the key-transfer operation.
A programming error in the script caused eight elliptic-curve cryptographic private keys to become extremely weak. Instead of retaining their intended cryptographic strength, the affected keys were reduced to unusually small numerical values.
The eight values identified in the investigation were:
| Affected key | Numerical value |
|---|---|
| Key 1 | 4 |
| Key 2 | 56 |
| Key 3 | 66 |
| Key 4 | 115 |
| Key 5 | 155 |
| Key 6 | 156 |
| Key 7 | 230 |
| Key 8 | 237 |
These numbers were so small that cybersecurity researchers could reconstruct the corresponding private keys using information available in the public domain.
The weakness meant that an attacker could potentially recover the private keys without needing to compromise eMudhra’s hardware security systems.
Why the Weak Keys Created a Major Internet Security Risk
eMudhra operates as a Certificate Authority (CA), an organisation responsible for issuing digital certificates that help establish trust between websites and their visitors.
Digital certificates are an essential part of HTTPS security. They help browsers verify website identities and establish encrypted connections between users and websites.
When someone visits a website using HTTPS, the browser checks its digital certificate to determine whether it can trust the website’s identity.
Certificate Authorities play an important role in this process because their digital signatures help establish that trust.
However, if attackers obtain the private keys of an intermediate Certificate Authority, they may be able to generate fraudulent digital certificates.
Such certificates could potentially allow malicious websites to impersonate legitimate websites and intercept encrypted communications.
In eMudhra’s case, the weak keys created a serious risk because the affected intermediate certificates were part of internationally trusted certificate chains.
This meant that the potential consequences extended beyond eMudhra’s own customers to the wider internet security ecosystem.
Eight Additional RSA Keys Also Raised Security Concerns
The latest investigation revealed another problem involving eight additional RSA-4096 keys.
According to the incident report, these keys remained cryptographically intact. However, the same Python script created copies of their private-key material in the ordinary memory of a computer during the transfer process.
This was a security concern because sensitive private keys are supposed to remain protected within the intended hardware security boundary.
The company could not guarantee that these additional keys had maintained its required security standards.
As a precaution, eMudhra revoked all 16 affected certificates associated with the eight weak elliptic-curve keys and eight additional RSA keys.
This disclosure expands the technical scope of the original incident, which initially focused on eight weak intermediate certificate keys.
How the Security Flaw Went Undetected for 18 Months
One of the most concerning aspects of the incident is the length of time the weak keys remained undetected.
The affected keys were generated in April 2025, but the problem came to light only in October 2026.
During this period, eMudhra’s certificate infrastructure underwent independent security audits and remained included in major browser trust programmes.
The keys continued functioning within the certificate infrastructure, meaning the weakness was not immediately apparent through routine operational checks.
However, their cryptographic strength had not been adequately verified.
The incident exposed gaps in the company’s key-generation procedures, particularly around validating cryptographic material after transferring it between hardware security modules.
It also raised questions about why automated scripts handling sensitive security operations were not subjected to stronger validation and independent verification.
The incident demonstrates that a cryptographic system can appear to function normally while containing serious weaknesses that are not visible through ordinary operational monitoring.
Google, Apple, Microsoft and Mozilla Respond to the Incident
After an independent cybersecurity researcher discovered the weak keys in October 2026, the findings were reported to major technology companies and eMudhra.
Mozilla independently recovered the affected private keys, confirming that the weakness could be exploited.
Major browser and technology companies subsequently took steps to remove trust in the affected certificate infrastructure.
These included:
- Google: Took action through its browser security and certificate trust programmes.
- Mozilla: Blocked affected certificates through Firefox’s certificate revocation mechanisms.
- Apple: Took steps to address the affected certificate trust chains.
- Microsoft: Updated its certificate trust protections.
CERT-In, India’s national cybersecurity agency, also issued an advisory describing the incident and clarifying which eMudhra services were affected.
The response highlighted the importance of cooperation between Certificate Authorities, browser developers and cybersecurity researchers in protecting the internet’s trust infrastructure.
eMudhra Exits Global Website Security Certificate Business
Following the incident, eMudhra announced its decision to exit its global website security certificate business.
The company acknowledged that the security failure had created a significant trust deficit within the international cybersecurity ecosystem.
The affected global TLS business represented approximately 1% of eMudhra’s revenue, according to the company’s earlier disclosures.
However, the reputational consequences extended beyond the financial contribution of that business.
The incident also attracted investor attention, with eMudhra shares experiencing a sharp decline following the disclosure.
The company has apologised publicly and committed to reviewing its internal security procedures.
It has also been cooperating with browser root programmes and customers to support the transition away from the affected certificate infrastructure.
Are India’s Digital Signature and eSign Services Affected?
Despite the international security concerns, eMudhra has maintained that its Indian Digital Signature Certificate (DSC) and eSign businesses were not affected.
CERT-In also clarified that the incident concerned eMudhra’s international website security certificate operations rather than its separately operated Indian digital signature infrastructure.
The two businesses operate using separate infrastructure and cryptographic keys.
Accordingly, India’s domestic DSC and eSign services continued operating normally, according to the company and the government cybersecurity advisory.
This distinction is important because digital signature certificates and website TLS certificates serve different purposes.
Digital signature certificates help authenticate individuals and organisations and support electronically signed documents. TLS certificates establish the identity of websites and help secure communications between browsers and servers.
The incident concerned the latter.
The Bigger Picture
The eMudhra incident highlights the risks associated with software automation in critical cybersecurity infrastructure. Python is widely used for scripting, automation and data processing, but errors in programs handling cryptographic material can have consequences far beyond ordinary software bugs. The incident demonstrates why sensitive key-generation and transfer operations require strict validation, hardware-backed security controls and independent verification.
It also raises broader questions about the effectiveness of cybersecurity audits. Despite the affected infrastructure undergoing independent audits, the weakness remained undetected for approximately 18 months. For the wider internet ecosystem, the incident reinforces the importance of continuous security monitoring, responsible vulnerability disclosure and stronger oversight of organisations responsible for issuing trusted digital certificates.
Looking Ahead
eMudhra’s latest report provides a clearer explanation of how the Python script error weakened eight cryptographic keys and exposed additional concerns involving RSA private-key handling. The company has already exited its global website security certificate business, revoked the affected certificates and apologised for the incident. The focus will now shift toward understanding the effectiveness of its corrective measures and the lessons other Certificate Authorities can draw from the failure.
For the broader cybersecurity industry, the incident serves as a reminder that even established security providers can experience serious failures when critical processes lack adequate safeguards. As digital certificates become increasingly important for online banking, e-commerce, government services and enterprise communications, stronger cryptographic validation and independent security controls will remain essential to maintaining trust across the internet.
SEO Metadata
- SEO Title: eMudhra Blames Python Script Glitch for Eight Weak Digital Keys
- Meta Description: eMudhra reveals how a Python script error created eight weak cryptographic keys, exposing serious security flaws in its digital certificate infrastructure.
- Permalink: emudhra-python-script-glitch-weak-digital-keys
- Focus Keyword: eMudhra weak digital keys
- Secondary Keywords: eMudhra security incident, Python script error, cryptographic keys, digital certificates, cybersecurity, TLS certificate security
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
