eMudhra hires KPMG after regulatory filing on compromised private keys
Digital certificate provider eMudhra has brought in KPMG to investigate a recent cybersecurity incident involving compromised private keys.
The issue, announced in a regulatory filing on October 30, 2026, stems from vulnerabilities found in eight of their digital certificates.
This move follows eMudhra's earlier promise to get an outside review after the incident came to light.
April 2025 script error weakened keys
A script error during key generation back in April 2025 led to weak keys that hackers could exploit. As a result, major technology companies, including Google, Microsoft, Apple, and Mozilla, took action against the affected certificates. Microsoft even removed several from its trusted list.
In response, eMudhra is stepping away from the global SSL/TLS business (but says this won't really hurt its revenue). India's IT Ministry is also looking into things but reassures that eMudhra's local services are still safe.
With KPMG now involved, the company hopes to fix issues and win back trust.