New Delhi: eMudhra has appointed KPMG to conduct an independent review of the compromise of its digital certificate keys, the Bengaluru-based company told the stock exchanges Friday.
KPMG is one of the world’s four largest accounting and professional services firms, alongside Deloitte, EY and PwC. Besides auditing company accounts, these firms are often engaged to investigate corporate failures, including cybersecurity incidents.
In a filing signed by company secretary Johnson Xavier, eMudhra said the appointment followed its 21 October press release, in which it had committed to engaging “an independent external reviewer”. The filing, however, does not specify the scope of the review, its expected completion date or whether its findings will be made public.
The review concerns eight certificates in eMudhra’s global website security business. These certificates are digital credentials that allow browsers to verify a website’s authenticity. Each relies on a private key, a secret number that should be randomly generated and typically be about 115 digits long. On 17 October, a researcher discovered that the private keys behind all eight certificates were numbers below 256—one was the number 4. Anyone who obtained such a key could generate certificates that browsers would trust for any website, allowing them to impersonate legitimate sites.
eMudhra attributed the flaw to an error in a software script used during a key generation ceremony on 30 April 2025. Such ceremonies are formal, recorded procedures through which certificate authorities generate their keys. The company said staff used the weak keys by mistake.
BDO, which audits eMudhra’s global business, did not detect the compromised keys. On 21 October, the Internet Freedom Foundation, a digital rights organisation, wrote to eMudhra seeking an independent audit by a firm it had not previously engaged. It also called on the company to publish the results of a re-checking of every key generation ceremony it had conducted, including those for its domestic digital signature business.
Browser makers have also been pressing eMudhra for answers on Mozilla’s public incident tracker. Mozilla sent the company questions on 20 October and set a 24-hour deadline, but eMudhra asked for more time. Google’s Chrome team, meanwhile, asked the company to identify the organisations replacing affected certificates, specify how many needed to be reissued and provide a timeline. Although eMudhra has committed to publishing a comprehensive root-cause report, it has not given a date for its release.
Also Read: Anthropic study’s new AI cautionary tale: AI agents can influence expert opinion to serve bias
Second incident raises further concerns
A separate incident was reported on 25 October, when researchers found that eMudhra’s servers were rejecting requests from commonly used software tools seeking its certificate revocation lists. These files allow computers to check which certificates have been cancelled and they include the lists announcing the eight revoked certificates.
In a report dated 29 October, eMudhra attributed the issue to a firewall setting that had been in place since September 2022. The company said it removed the setting on 26 October.
Mozilla, Google, Apple and Microsoft have all blocked eMudhra’s compromised certificates. Microsoft removed seven eMudhra-linked root certificates—the master certificates at the top of a chain of trust—from Windows on 26 October and its Edge browser on 27 October. Chrome’s removal of eMudhra’s emSign ECC Root CA – G3 was scheduled for 27 October.
Google and Microsoft are reviewing eMudhra’s remaining root certificates, at least seven of which are used by Indian banks for their websites, according to a scan by consumer platform CashlessConsumer.
On 22 October, eMudhra announced that it would exit the global website certificate business, which accounts for about 1 per cent of its revenue, according to the company. The Ministry of Electronics and Information Technology has constituted a team to investigate the incident and said eMudhra’s domestic digital signature and eSign services remain unaffected.
The company’s shares fell to a 52-week low of Rs 318 on 26 October, around 53 percent below their 16 September high.
(Edited by Chingkheinganbi Mayengbam)