Public statement: eight “secret” keys anyone could guess. One was the number 4. And no Indian authority has said a word.

We are CashlessConsumer, a consumer collective working on digital payments and public digital infrastructure. Below is a failure most Indians will never see, in a system everyone depends on. Every claim here is sourced. Where we checked something ourselves, we say so.

What happened. The padlock in your browser stands for a promise: this really is your bank. Keeping that promise is the job of companies called Certificate Authorities, which browsers agree to trust. One of the most embedded of them in India is eMudhra Ltd of Bengaluru: licensed by the Controller of Certifying Authorities (CCA India),¹ listed on the stock exchanges, and a certificate supplier to government websites.

Between 1 and 10 October 2026, eMudhra created eight intermediate certificates. Their private keys were not random. A key of this class should allow about 2³⁸⁴ possible values; these eight contained 3 to 8 bits of actual randomness. Their values were 4, 56, 66, 115, 155, 156, 230 and 237. One of the “unknowable” keys of one of India’s largest trust companies was the number 4. An AI agent recovered a key on its first attempt with a one-line prompt, as recorded in the Mozilla incident tracker by the researcher coordinating the response.²³

Anyone holding such a key can mint a credential for any website on earth (your bank, Gmail, UIDAI), and browsers will call it genuine. The padlock shows. No warning appears. This is not a forecast: the keys are public, and deriving all eight takes minutes on a laptop.

Who caught it. A researcher known as “Wayne” reported the flaw on 17 October 2026, proving control of the keys by signing a message with each one. Firefox and Chrome stopped trusting all eight intermediates within hours. Apple followed on 19 October. A public disclosure site with test endpoints went up on 20 October.⁴ The system worked. It worked because of a volunteer researcher, an AI agent, and browser security teams sitting outside India.

What we are not saying. We make no allegation of misuse. We did not investigate whether anyone exploited these keys; that requires powers and access we do not have. Certificate Transparency shows nothing was minted from them, and we treat that as a reason to investigate calmly, not as a certificate of innocence. Our demand stands whether or not any harm occurred: the failure itself, and the silence around it, are the case.

What no Indian authority has said. As of 21 October 2026, we could not find a public statement, order or incident record on this matter from CCA India, RBI, IDRBT, UIDAI or GeM. The statutory body that licenses eMudhra has published nothing. There is no public incident process for Indian-licensed CAs at all. Certificate auditors in India are chosen and paid by the companies they audit.

The vendor’s own account, on the public record, does not comfort. Keys meant to stay locked inside tamper-proof hardware were made exportable under an “approved deviation” and shipped to data centres in the US and EU, in the name of “data sovereignty”. Indian policy insists data stay in India; the vendor made the keys portable instead. When revocation lists signed with the correct keys failed verification, eMudhra re-signed them with the broken keys rather than halting issuance and investigating.⁵ We ask the obvious question: if a licensed trust company cannot stop itself from signing with a key it knows is broken, what exactly did the licence certify?

Why this lands on Indian desks. Our own desk checks, 20–21 October 2026, from Indian and sandbox vantages:⁶

• uidai.gov.in and gem.gov.in, the Government e-Marketplace, serve website certificates issued by eMudhra. We offer this as a fact of jurisdiction, not as evidence of compromise: these chains are different from the compromised ones and remain trusted.
• IDRBT, the RBI-established institute that certifies Indian banking, builds its issuance on eMudhra’s emCA platform, with over 3,00,000 certificates issued for interbank messaging and national payment systems.⁷⁸
• Chrome is formally reviewing “the status of eMudhra’s remaining CA certificate”.⁹ If that root goes, these websites stop loading in updated browsers until they migrate. Consumers would bear a vendor’s failure.
• The devices least likely to ever receive a trust update are years-old Android phones, smart TVs and forgotten servers. That is also a fair description of what most Indians use. The long tail of this incident is Indian.

What we ask. Two things, in order: an open and verifiable investigation, and a remediation path for consumers if it finds harm. The full open letter to RBI and MeitY follows below. In summary:

1. An open, verifiable, published investigation into eMudhra’s licensed operations: the key-generation ceremonies behind the eight certificates, the “approved deviation” that made keys exportable, the transfer of keys overseas, and the re-signing of revocation lists with a known-broken key. Evidence preserved, findings public.
2. CERT-In: confirm whether this incident was reported within the 6-hour window the April 2022 directions require, and publish the action taken.¹⁰
3. A standing public incident process for licensed CAs, on the model Mozilla and Chrome already run free of charge for the same vendors.
4. Certificate audits appointed and paid by the regulator, not the vendor.
5. A consumer remediation framework agreed in advance: if the investigation establishes any interception, affected people are notified and made whole, the cost falls on the responsible vendor, and liability between certificate authority, website operator and payment provider is settled by rule, not by fight.
6. UIDAI, GeM and IDRBT: publish your certificate issuers and pre-position migration away from eMudhra roots, sequenced with browser makers so no distrust decision lands on users unannounced.
7. RBI: guidance to regulated entities on trust-store updates in banking apps and channels.

What you should do today. Update your browser, phone and computer. That one step covers most of the risk. If you run servers, containers or CI systems, list everything that checks certificates and update its trust stores. If your organisation buys eMudhra certificates, ask for the root-cause analysis in writing.

Crores of us press “pay” every day and never think about the padlock. The machinery that keeps the padlock honest sits mostly outside India, and the part inside India has no public way to prove it works. It should not take a foreign bug tracker for the country to learn its own bank’s front door is sound.

— CashlessConsumer · cashlessconsumer.in · cashlessconsumerin@gmail.com