By Karan Bhatty, Founder, Millow
Having spent my career in background verification, I read the eMudhra episode as a verification story first. A report is only as good as the chain behind it. A candidate makes a claim, an issuer confirms it, the screening firm checks the issuer, and the employer relies on the result. The weak link is rarely where people expect it.
Eight keys behind the Bengaluru company’s digital certificates turned out to be tiny numbers, one of them just four. Browsers blocked them within hours of a researcher’s report on October 17. eMudhra says a flaw in a key ceremony script in April 2025 produced the weak keys, and its own filing attributes the lapse to human errors. The company should own that.
What deserves equal attention is how long the keys sat in plain view. Security researcher Ryan Hurst, formerly of Google, writes that they were listed in the industry’s shared database in May 2025, and that Google has offered a free key testing tool since 2022. Run over all 10,313 authority certificates in that database, he says, it takes a fraction of a second. Chrome reviewed eMudhra’s hierarchy in November 2025, and an audit covering June 2025 to May 2026 ended with an unmodified opinion. No rule asked anyone to test the keys themselves. The question Hurst’s analysis raises is why a check this cheap, and this public, was never run, including by the Chrome Root Program.
Nor is eMudhra alone. Filings on Mozilla’s public tracker show GoDaddy revoking 403,643 certificates after missing a deadline, HARICA issuing 66,105 certificates that contradicted its own policy, and Sectigo reporting 441.4 million certificates caught in a dispute over policy wording, of which 108.9 million are still valid. I am not suggesting any of them deserves a harsher outcome. I am asking for the same yardstick.
One explainer on the eMudhra security scare describes eMudhra as the only Indian root authority trusted worldwide, so it is easy for the story to become about one country. The record points to a system.
Verification taught the industry this long ago. A clean audit of a screening firm’s process tells an employer that the steps were followed. It does not tell them the degree was real, so good practice is to go back to the source and repeat the check when circumstances change. Something true last year may not be true today. Digital trust needs the same habit.
Hurst proposes that the shared database scan every authority key on upload, which he says takes less than a second. It is the equivalent of confirming a certificate with the university and not just reading the folder it arrived in. The question is the same for a browser maker trusting an authority and an employer trusting a screening firm. What is checked, and who checks it?
Accountability belongs with the company that made the error. It also belongs with those placed to catch it. India’s digital economy rests on this kind of trust, and Indian companies will keep building within it. The way to protect that is to hold everyone in the chain to the same test, and to open the envelope instead of admiring the seal on it.