On 17 October 2026, a researcher using the handle Wayne was checking the Common CA Database when he found eight intermediate certificate authority keys belonging to Indian certifying authority eMudhra that were nowhere near random enough to trust. Security researcher Scott Helme recovered all eight on his own laptop in under a second, one of them logged simply as the number 4. He said an AI agent later repeated the same recovery from a single prompt, and that “nobody had to steal anything.”
The Flaw Two Audits Missed in eMudhra’s Certificate Authority Keys
The keys were created during a key generation ceremony on 30 April 2025. A faulty script produced a second, weaker set of keys alongside the properly generated ones, and because the labels on both sets looked identical, staff in the ceremony selected the wrong keys to publish to browser trust stores. That hierarchy then passed two independent audit cycles over the following eighteen months before anyone noticed. eMudhra revoked all eight intermediates within fourteen hours of being told. Chrome and Firefox blocked them the same day. Apple followed on 19 October, Microsoft on 20 October. Chrome is scheduled to remove the affected root from its trust store entirely on the morning of 27 October, and eMudhra itself estimates roughly 30,000 customer certificates now need replacing. India’s CERT-In said it had seen no evidence the weak keys were used maliciously during the eighteen months they sat undetected, though nobody can rule it out.
The Decision That Actually Matters
None of that sequence is unusual for a security incident. What happened five days later is. On 22 October, eMudhra’s board announced the company would exit the global SSL and TLS certificate business entirely, rather than remediate the ceremony process and continue issuing certificates under tighter controls. Chairman V. Srinivasan called it “the right decision for eMudhra and its shareholders,” and said the scrutiny the business had drawn was “out of proportion to SSL/TLS’s place in our business.”
Most organisations facing a flaw this basic choose the other path: patch the process, reassure customers, keep the revenue. eMudhra’s own account of the business, SSL and TLS at roughly one per cent of total revenue inside a much broader digital solutions portfolio, makes clear the exit was also a straightforward cost calculation, not a selfless one. The business was small enough, and the reputational cost loud enough, that leaving was the cheaper option. That does not make the decision wrong. It does mean the lesson is not that good governance looks like walking away. It is narrower and more useful than that. When a flaw sits underneath something customers trust by default, and the audits that were supposed to catch it did not, the organisation that owns it has to weigh the true cost of continuing against the cost of stopping, honestly, rather than defaulting to continuing because stopping feels drastic.
What This Actually Tests
Two completed audit cycles missed a flaw that any attacker with a laptop, or by October 2026 a single AI prompt, could have exploited for eighteen months. An audit that passes is evidence a control was checked. It is not evidence the control works. The same blind spot shows up in why privileged access, not a distracted employee, has become the expensive part of most security programmes, where the control that gets checked is rarely the one that actually gets tested. Any organisation relying on a periodic audit cycle as its main assurance that a foundational system is safe is relying on exactly the mechanism that failed eMudhra for a year and a half.
Three questions make that choice concrete rather than abstract. Does your organisation know which of its own systems default to being trusted without anyone having to approve that trust each time, the way a browser trusts a certificate chain. Has anyone checked, this year, whether the audit covering that system tests the actual mechanism or just confirms a document was signed off on schedule. And if that system failed tomorrow the way eMudhra’s keys did, would the honest internal answer be fix it quietly, or admit the business built around it should not continue in its current form.
Pick the system in your own organisation that customers trust by default because it has always been there, the one nobody has asked what would we actually do if this failed about since it was built. Name who owns the answer to that question, and ask them whether the honest answer is remediation or exit, before an outside researcher forces the choice.
