eMudhra, an Indian licensed certificate authority, exposed weak private keys that allowed the issuance of valid website certificates, leading Mozilla and Chrome to block these certificates on October 17. The flaw was reported by researcher Dennis Jackson on Mozilla’s Bugzilla forum the same day. eMudhra revoked the affected certificates on October 18, according to medianama.com.
The vulnerability involved private keys that were poorly configured and consisted of numbers below 256, making them easy to recover. Jackson demonstrated that AI agents could retrieve a key on the first attempt with a simple prompt. Mozilla independently recovered the keys within hours without knowledge of Jackson’s method. eMudhra’s press release acknowledged that AI-assisted techniques could reverse-engineer the keys, confirming the security lapse.
This incident highlights significant risks in digital certificate security, especially as AI tools can accelerate key recovery and exploitation. The breach follows CERT-In warnings about unauthorized AI agent access to Indian IT systems. Although eMudhra stated the affected global business contributed about 1% of its revenue, it warned of unquantifiable reputational damage. The event underscores growing challenges in securing cryptographic infrastructure amid advancing AI capabilities.
eMudhra’s October 21 press release confirmed the revocation of the weak keys and emphasized the potential reputational impact. The company has not disclosed further remediation steps or financial implications, leaving the extent of the fallout to be assessed in coming audits and regulatory reviews.