eMudhra Taps KPMG to Probe Digital Certificate Security Lapse
eMudhra appoints KPMG as an independent reviewer after browser giants distrusted its digital certificates due to a security incident.
Bengaluru-based cybersecurity and digital trust firm eMudhra Limited has officially appointed KPMG as an independent external reviewer to investigate a critical eMudhra digital certificate security incident. This move comes after several major global browser companies expressed distrust in a set of the company's intermediate digital certificates, sparking concerns over website security and impersonation risks.
The Root of the Crisis: Weak Keys and Browser Distrust
The security lapse centered around eight intermediate Certificate Authority (CA) certificates used within eMudhra's global website security operations. The core of the problem was the discovery that the private keys associated with these certificates were mathematically weak. This vulnerability meant the keys could potentially be calculated, creating a loophole where malicious actors could generate fraudulent certificates to impersonate legitimate websites.
Recognizing the potential risk to millions of users, tech giants including Google and Mozilla acted swiftly to distrust the affected certificates, effectively blocking them to ensure web safety.
Human Error and Script Failure
In a detailed explanation provided to ANI, eMudhra Co-Founder Kaushik Srinivasan clarified that the incident was not the result of a sophisticated cyberattack or an external breach. Instead, he attributed the failure to a combination of human error and a technical glitch.
According to Srinivasan, the issue occurred on April 30, 2025, during a routine key-generation process. A script error led to the creation of weak cryptographic keys directly on the hardware. He admitted that the company lacked the necessary manual checks that could have caught and prevented this error before the certificates were deployed.
Key Takeaways from the Company:
- No Data Breach: The company maintains that there was no infrastructure breach or leakage of customer data.
- Limited Impact: It was stated that only a small number of customers were directly affected by the incident.
- Internal Failure: The lapse is categorized as a procedural and script-based error rather than a security breach.
The Path to Recovery with KPMG
The appointment of KPMG is a fulfillment of a promise made by eMudhra in a press release dated October 21, where the company committed to bringing in an independent entity to examine the matter. By involving an external auditor, eMudhra aims to provide full transparency regarding the incident.
The independent review is expected to dissect the sequence of events, validate the company's claims regarding the nature of the error, and help eMudhra implement more robust safeguards to prevent similar occurrences in the future. This step is crucial for the company to regain the trust of global browser authorities and its client base.