eMudhra blames key ceremony flaw for laughably weak private keys

Indian certificate authority eMudhra said a flaw in its April 30, 2025 Key Generation Ceremony caused weak private keys, including one that was just the number "4," to be published to browser root stores. The company said its roots passed independent audits for two years and is issuing replacement certificates to affected customers.

• One private key was literally the number "4"; others were short 2–3 digit strings
• The flaw occurred during key generation on FIPS 140-2 Level 3 HSMs on April 30, 2025
• TLS accounts for just 1% of eMudhra's revenue; the company acknowledged reputational risk
• Replacement certificates are being issued while root-cause investigation continues