Third-party auditors audited eMudhra twice while the certificate authority was actively signing certificates with weak private keys