Government Forms Special Team to Investigate eMudhra Digital Certificate Leak

India’s Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the compromise of private cryptographic keys associated with eight digital certificates issued by Bengaluru-based eMudhra. The government has taken serious note of the incident, while the Indian Computer Emergency Response Team (CERT-In) has issued a cybersecurity advisory outlining the risks and mitigation measures.

The incident concerns eMudhra’s international digital certificate business, which helps browsers and operating systems establish trust in websites and software. The company has attributed the weakness to an error during a key-generation process conducted in April 2025. MeitY has said the impact on Indian websites and applications was very limited, and that India’s regulated Digital Signature Certificate (DSC) and eSign services remain unaffected.

Key Takeaways

• MeitY has constituted a special team to investigate the eMudhra digital certificate incident.
• Eight intermediate certificate authority certificates were affected: six associated with website security and two with code signing.
• CERT-In said insufficient cryptographic randomness compromised the private keys.
• The weakness could potentially enable fraudulent certificates and website impersonation.
• eMudhra has attributed the problem to an error during a key-generation ceremony in April 2025.
• The company says its domestic digital signature and eSign services are unaffected.
• The incident has raised questions about cryptographic controls, certificate authority oversight and internet trust infrastructure.

What Happened in the eMudhra Digital Certificate Leak?

The incident involves eight intermediate Certificate Authority (CA) certificates associated with eMudhra’s public-key infrastructure. These certificates form part of the system that allows browsers and other software to verify digital identities and establish secure connections.

The issue became public after a security researcher reported that private keys associated with the certificates could be recovered because they had been generated with insufficient cryptographic randomness.

A private key is a secret cryptographic value used to establish authenticity and support secure communications. If a certificate authority’s private key is compromised, an attacker may be able to create fraudulent certificates that appear to originate from a trusted authority.

CERT-In warned that such certificates could be used to impersonate legitimate websites and potentially facilitate man-in-the-middle attacks. In those attacks, a malicious party may intercept or modify communications if the relevant network conditions and certificate trust arrangements allow it.

The incident does not automatically mean that every website using eMudhra certificates was compromised. The actual risk depends on the certificates involved, whether fraudulent certificates were issued or used, and whether browsers and other systems continued to trust the affected certificate chains.

How Did the Cryptographic Weakness Occur?

According to eMudhra’s explanation reported by news outlets, the issue originated during a Key Generation Ceremony conducted on April 30, 2025.

The company said a flaw in the process caused a cryptographic key-handling operation, known as wrap/unwrap, to generate a second set of weak keys alongside the original, stronger keys. The weak keys were subsequently published to browser trust stores instead of the intended strong keys.

This distinction is important. The company has described the incident as a failure in the key-generation process rather than evidence that an attacker broke into its infrastructure and stole the keys through a conventional intrusion.

However, the explanation also raises questions about how the key-generation procedure was tested, how the resulting keys were validated and why the weakness was not identified before the certificates entered the trust ecosystem.

eMudhra has said it is conducting a root-cause investigation and reviewing its security controls and operational procedures. The final findings will be important for understanding the precise failure and determining what additional safeguards may be required.

Which Certificates Were Affected?

CERT-In identified eight compromised intermediate CA certificates in eMudhra’s public-key infrastructure.

Certificate type	Number affected	Primary purpose
Transport Layer Security (TLS)	6	Supporting website identity verification and secure connections
Code-signing certificates	2	Supporting verification of software publisher identity and signed software
Total	8	Affected intermediate certificates

TLS certificates help browsers determine whether a website’s identity can be trusted. They are widely used by websites operating over HTTPS.

Code-signing certificates serve a different purpose: they help operating systems and applications verify the publisher and integrity of digitally signed software. A compromised code-signing certificate can therefore create risks beyond website impersonation, depending on how a certificate is used and trusted.

eMudhra has said the affected certificates were contained and that it began working with browser and root-store operators to address the issue. The company has also stated that it is working with potentially affected customers to provide replacement certificates where required.

What Is the Government Doing?

MeitY has constituted a special team to investigate the incident and said it remains engaged with relevant stakeholders to resolve the matter.

CERT-In has issued an advisory describing the vulnerability and recommending mitigation measures for organisations and system administrators. The government has also sought to distinguish the affected international certificate operations from eMudhra’s domestic digital signature services.

According to MeitY, eMudhra operates two separate areas of business:

• Domestic digital signature and eSign services: These are regulated by the Controller of Certifying Authorities (CCA) under MeitY.
• International digital certificate services: These support website, software and online communication security under a global trust framework.

The ministry has said the incident relates to the second area and that domestic DSC and eSign services remain unaffected. It has also said that further details will be shared after the investigation is completed.

The investigation will need to establish the cause of the weak-key generation, assess the effectiveness of existing safeguards and determine whether additional remedial action is necessary.

How Google and Mozilla Responded

Browser providers play a critical role in deciding which certificate authorities their software trusts. After the weakness became known, major browser ecosystem operators took steps to block the affected certificates.

Google said it blocked affected public keys through a Certificate Revocation List Set update in Chrome. Mozilla also moved to block the affected TLS certificates through its certificate-revocation mechanisms.

These actions are intended to prevent affected certificates from continuing to be trusted by the relevant software. However, certificate trust changes can take time to reach every environment, and different browsers, applications and operating systems may use different trust stores or update schedules.

Organisations that depend on affected certificate chains should therefore follow official vendor guidance, review their certificate configurations and replace certificates where required. Keeping software updated is also important because security fixes and trust-store changes may be delivered through software updates.

Impact on Indian Websites and eMudhra’s Business

MeitY has described the impact on Indian websites and applications as very limited and brief. It has separately confirmed that domestic DSC and eSign services regulated by the CCA remain unaffected.

eMudhra has also said its infrastructure was not compromised and that the incident did not result in a data breach. These statements distinguish the cryptographic weakness from a reported intrusion into the company’s systems, although the investigation is still needed to establish the complete circumstances.

The company has said the affected global TLS business accounts for approximately 1% of its revenue. While this suggests that the directly affected business is relatively small in revenue terms, the incident could still create reputational risks and additional costs associated with remediation, replacement certificates and customer support.

The company’s shares fell 20% to the lower circuit on the National Stock Exchange on October 21, 2026, according to reports following the disclosure. The market reaction illustrates how a security incident can affect investor confidence even when the affected business represents a limited portion of total revenue.

What Businesses and Users Should Do

Organisations managing websites, applications or software distribution systems should review the official CERT-In advisory and guidance from relevant browser and software vendors.

Recommended precautions include:

• Apply browser, operating-system and software updates promptly.
• Review certificate chains to identify any reliance on affected certificates.
• Replace affected certificates in line with vendor instructions.
• Verify that certificate revocation and trust-store updates have been applied.
• Monitor official security advisories for additional findings or remediation requirements.

Individual users should keep their browsers and devices updated and remain alert to suspicious websites and unexpected requests for credentials or payments. They should avoid assuming that every website using a digital certificate is automatically safe, since website security also depends on other technical and operational safeguards.

The Bigger Picture

The eMudhra incident demonstrates why cryptographic key generation is a critical part of digital security. Certificate authorities occupy an important position in the internet’s trust infrastructure: their certificates help browsers verify websites and help users distinguish legitimate digital services from potential impersonators. A weakness in key generation can therefore have implications beyond the organisation that created the certificates.

The government’s investigation, CERT-In’s advisory and the actions taken by browser providers highlight the need for strong cryptographic controls, independent review and rapid coordination when vulnerabilities are discovered. The final outcome will depend on the investigation’s findings, the effectiveness of remediation and whether additional weaknesses are identified. For businesses, the immediate priority is to verify certificate configurations and apply relevant updates rather than relying solely on general assurances about the incident’s limited impact.

FAQs

1. What is the eMudhra digital certificate leak?

It is a security incident involving weak cryptographic private keys associated with eight intermediate certificates in eMudhra’s international certificate infrastructure. The weakness could potentially allow fraudulent certificates to be created.

2. Why has the government formed a special investigation team?

MeitY has formed the team to investigate how the weakness occurred, coordinate with stakeholders and help determine the necessary remedial measures.

3. Are Indian digital signature and eSign services affected?

MeitY and eMudhra have said the domestic DSC and eSign services remain unaffected because they operate separately from the international certificate business involved in the incident.

4. Can compromised certificate keys be used to create fake websites?

Potentially, yes. A compromised certificate authority key can be used to issue fraudulent certificates for domains the attacker does not control. Whether an attack succeeds depends on certificate trust, software protections and other technical conditions.

5. What should website owners do after the incident?

Website owners should review CERT-In and vendor advisories, check whether their certificate chains are affected, apply security updates and replace affected certificates where necessary.

Looking Ahead

MeitY’s special team will investigate the circumstances behind the weak cryptographic keys, while eMudhra continues its own root-cause review and works with certificate ecosystem operators. The key questions are how the key-generation error passed existing controls, whether any further weaknesses exist and whether additional security measures are needed across affected systems.

The incident is a reminder that trust in digital services depends on sound technical controls as well as regulatory oversight and transparent incident response. Although the government says the impact on Indian websites was limited and domestic digital signature services remain unaffected, businesses should continue to follow official advisories and verify that their certificate configurations are secure. The investigation’s findings will help clarify the extent of the incident and the measures needed to reduce the risk of a similar failure in the future.