eMudhra Explains Python Error Behind Major Internet Security Scare

The Indian cybersecurity company eMudhra has finally explained how a major security problem involving its certificates happened, putting websites and internet users at possible risk. In a report about the event posted on the open-source bug-tracking site Bugzilla the company said that a mistake, in a Python script caused the creation of eight very weak security keys.

The event became known month when security experts found out that some of the keys eMudhra used to create digital certificates were much shorter than they needed to be. These keys were very easy to break. Hackers could have figured them out. Used them to get digital certificates, for fake websites.

Following the discovery, major technology companies, including Google, Mozilla, Apple and Microsoft, moved quickly to release security updates to protect users and their platforms.

What caused the eMudhra security incident?

To understand the problem, it is important to know how digital certificates work. eMudhra operates as a Certificate Authority (CA)-an organization responsible for issuing digital certificates that help verify the identity of websites. These certificates establish secure connections and are typically indicated by a padlock icon next to the website address in web browsers.

However, it was discovered that eight security keys generated by eMudhra were extremely weak. Although the keys were expected to contain 115 digits, some were reduced to surprisingly small figures. Reportedly, one of them consisted solely of the number 4.

According to the company's report, the problem began during a key generation ceremony held on April 30, 2025. The keys were initially generated successfully using a Hardware Security Module (HSM), a specialised device designed to protect sensitive cryptographic information.

The trouble began when eMudhra ran a custom Python script to handle the keys before moving them to another hardware device. There was a bug, in the script. It accidentally changed eight keys into the numbers: 4, 56, 66 115 155, 156 230 and 237.

The company admitted that these numbers were small enough that anyone could figure out using information that's available, to the public.

Why did the problem go unnoticed?

One of the worrying aspects was how long the weak keys stayed unnoticed. For 18 months the company kept issuing digital certificates without any warning. The company said that the strength of the certificates had not been properly tested during that time.

The report also showed that eight other keys were still working fine. The same script made copies of them in the memory of a regular computer. The company explained that this was its attempt at moving keys, between hardware security modules that sit in different places. The company has now changed its method. The company now creates keys directly. Does not move them between devices.

After the incident eMudhra completely left the certificate business and issued a public apology. The discovery raised concerns, among cybersecurity experts. Some warned that the vulnerability could have led to damage to internet security.

ABOUT THE AUTHOR

Kahekashan

[email protected]

Kahekashan is a passionate technophile with a keen eye for cutting-edge gadgets, emerging technologies, and everything in the digital realm. Raised in a Defence family with strong values and a background in literature, she has consistently pursued excellence in every endeavour. Her last full-time assignment involved content writing with the Indian School of Business.

Read More