loading
loading
eMudhra taps KPMG for independent review of weak key generation security incident - Published OnOct 30, 2026 | 12:57 IST - Last Updated OnOct 30, 2026 | 12:57 IST Digital trust firm eMudhra has hired KPMG for an independent audit after a critical cryptographic lapse in its global certificate infrastructure triggered regulatory probes and browser blocks, leading the firm to exit the TLS business. Discover how officials plan to evaluate its domestic operations. Digital trust company eMudhra has appointed KPMG to conduct an independent review of the security incident involving the generation of weak private keys linked to eight intermediate digital certificate authorities, the company said on Friday, October 30. The appointment follows the company's earlier commitment to bring in an independent external expert to examine the incident, which exposed a vulnerability in its global digital certificate infrastructure and triggered scrutiny from cybersecurity experts, regulators and major technology companies. In a communication on Friday, eMudhra said, "Regarding the reported incident, wherein we had stated our commitment to appoint an independent external reviewer, we wish to inform you that the Company has appointed KPMG to undertake an independent review of the matter." The review comes days after the company faced questions over its handling of the incident, including concerns about the security of its certificate infrastructure, the time taken to respond to queries and the potential implications for internet security. The security incident has also weighed on investor sentiment. Over the past 10 days, eMudhra shares have shed nearly 20%, falling from ₹432 at the October 21 close to ₹346 at the October 29 opening, as the security lapse put the company under investor scrutiny. How the eMudhra security lapse surfaced The issue first came to light on October 17, when a security researcher known as Wayne reported that private keys associated with eight intermediate Certificate Authority (CA) certificates issued by eMudhra could be recovered. The keys had an effective key space of just three to eight bits, making them highly vulnerable to guessing and recovery. The incident involved eight intermediate certificate authorities created during a key-generation exercise in April 2025 as part of eMudhra's publicly trusted certificate infrastructure. Digital certificates help browsers establish whether a website is genuine and whether an encrypted connection is being established with the intended server. Intermediate CAs act as links between trusted root certificate authorities and the certificates issued to individual websites. A compromise of an intermediate CA's private key can potentially allow attackers to generate fraudulent website certificates, impersonate legitimate websites and interfere with encrypted communications, depending on the authority's permissions and the trust placed in its certificates. On October 21, the Indian Computer Emergency Response Team (CERT-In) issued an urgent advisory flagging the compromise of the private keys. The government cybersecurity agency said the keys had been generated using insufficient cryptographic randomness, making them vulnerable to almost instantaneous recovery. The Ministry of Electronics and Information Technology (MeitY) also took serious note of the incident and constituted a special team to investigate the matter, government sources said on October 21. Government sources maintained that the impact on Indian websites and applications was very limited and lasted for a short period. They also clarified that Digital Signature Certificates and eSign services regulated by the Controller of Certifying Authorities (CCA) under MeitY remained unaffected. Major technology companies, including Google and Mozilla, also initiated emergency measures, including blocking the affected certificates, to limit potential risks to internet users. eMudhra exits SSL/TLS business Amid the growing scrutiny, eMudhra announced on October 22 that its board had decided to exit the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business. The company said the business contributed around 1% of its global revenue and cited evolving data sovereignty and compliance requirements, along with the availability of free SSL/TLS certificates, among the reasons behind the decision. eMudhra said it had revoked the affected intermediate certificate authorities within 14 hours of confirming the issue. Chairman V Srinivasan maintained that no end-entity certificates had been issued through the affected authorities, its infrastructure had not been breached and no data had been lost. The company also committed to arranging replacement certificates for affected customers at no additional cost through its partners. On October 23, former CERT-In director-general and India's first National Cyber Security Coordinator Gulshan Rai called for an audit of eMudhra's Indian operations, arguing that the security lapse in its global business warranted closer scrutiny of its domestic operations. Rai also called for the company's licence to be suspended until the audit was completed, citing eMudhra's involvement in critical digital services, including Aadhaar, income tax filing, Goods and Services Tax (GST) filing and Registrar of Companies (ROC) filings. Google questions eMudhra's response On October 26, eMudhra issued a public apology, acknowledging that the security flaw had originated within the company. "The flaw was ours," the company said, apologising to its customers, partners and the wider internet security community. It said its investigation had found no evidence that the affected authorities had issued publicly trusted certificates to websites or that its systems or customer data had been compromised. The company also clarified that its digital signature and eSign services in India and overseas, as well as its enterprise applications, operated on separate infrastructure and were not affected. As part of its response, eMudhra said it would replace certificates for affected customers and other customers using its TLS services at no additional cost. It also committed to publishing a detailed investigation through the Common CA Database (CCADB) process and appointing an independent expert to review the incident and its security controls. However, the company's handling of the disclosure and subsequent investigation drew further criticism. In a comment posted on Mozilla's Bugzilla platform, Naveen Kumar ML, representing eMudhra, sought additional time to investigate the incident and prepare a detailed report. He cited intense social media scrutiny and analysis by investors and customers as factors that had made meaningful analysis difficult. "There are a lot of questions here. As most of you can imagine, we have been subject to intense social media scrutiny and analysis by investors/customers over the last few days and it has made doing any meaningful analysis of the event pretty much impossible," the comment said. The explanation drew a sharp response from Google's Chrome Root Program, which said intense scrutiny from investors, customers or social media was not an acceptable reason for delaying a response to a security incident involving compromised certificate authority keys.
document fetched 2026-10-31 02:56 · canonical https://cnbctv18.com/market/emudhra-appoints-kpmg-independent-review-weak-key-generation-security-lapse-cyber-attack-security-20023163.htm