India’s Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate a security incident involving eMudhra, a provider of digital certificates and trust services. The ministry said the incident primarily concerns the company’s international website-security business and that the impact on Indian websites and applications has been very limited. It also confirmed that India’s regulated Digital Signature Certificate (DSC) and eSign services remain unaffected.
The incident came to light after researchers identified weak cryptographic private keys associated with eight intermediate certificates issued within eMudhra’s global certificate business. These certificates play a role in establishing trust between websites and browsers. Although compromised certificate-authority keys can create a risk of website impersonation, major browser providers have taken steps to block the affected certificates. India’s cybersecurity agency, CERT-In, has also issued an advisory outlining the vulnerability and recommended mitigation measures.
Key Takeaways
- MeitY has formed a special team to investigate the eMudhra security incident.
- The government says the impact on Indian websites and applications has been very limited and brief.
- India-regulated digital signature certificates and eSign services remain unaffected.
- The incident involves eight intermediate certificates with weak cryptographic private keys.
- Google and Mozilla have taken steps to block affected certificates.
- CERT-In has issued a security advisory, while eMudhra says it is investigating the root cause.
- Public disclosures as of October 21, 2026, do not establish confirmed malicious exploitation of the affected keys.
What Happened in the eMudhra Security Incident?
The incident concerns a weakness in the cryptographic keys associated with eight intermediate Certificate Authority (CA) certificates linked to eMudhra’s global public-key infrastructure.
Digital certificates help browsers and other software verify the identity of websites and establish encrypted connections. Certificate authorities issue these credentials through a chain of trust, with intermediate authorities operating between a trusted root authority and certificates issued to websites or other entities.
The problem arose because the private keys associated with the affected intermediate certificates were generated with insufficient cryptographic randomness. According to CERT-In, the weakness made the affected keys recoverable from their corresponding public information.
A private key is intended to be secret. If an attacker can recover a certificate authority’s private key, that attacker may be able to generate fraudulent certificates that appear to come from a trusted authority.
This could potentially allow a malicious website to impersonate a legitimate website or create trust-related risks for software distribution. However, the existence of a vulnerability does not automatically mean that attackers exploited it successfully.
Google said no TLS certificates chaining to the six affected website-security intermediates had appeared in Certificate Transparency logs before its blocking action. eMudhra also said the affected intermediate certificates had not issued end-entity certificates. These disclosures are important when assessing the practical risk, although the investigation remains relevant to understanding how the weakness occurred.
Why Has MeitY Formed a Special Investigation Team?
MeitY said it had taken serious note of the reported incident and constituted a special team to investigate the matter.
The ministry has emphasized that eMudhra operates two distinct areas of business. One covers Digital Signature Certificates and eSign services regulated by the Controller of Certifying Authorities (CCA) under MeitY. The other covers digital certificates used internationally to secure websites, software and online communications.
The current incident concerns the second area rather than India’s regulated DSC and eSign infrastructure.
Government officials have said they are also checking with other operators to determine whether additional issues exist. The ministry has cautioned against social media posts that exaggerate the incident’s potential impact.
The investigation will be important for determining how the weak keys were generated, whether security controls failed and what measures are needed to prevent similar incidents. It may also help establish whether further action is required for affected certificates or related systems.
Which eMudhra Services Are Affected?
The distinction between eMudhra’s international certificate business and its Indian digital-signature operations is central to understanding the incident.
| Service or area | Reported status |
|---|---|
| Indian Digital Signature Certificates | MeitY and CERT-In say these remain unaffected |
| Indian eSign services | Reported unaffected |
| Global website-security certificates | Eight intermediate certificates were affected |
| Website impersonation risk | Potential risk associated with compromised certificate-authority keys |
| Confirmed malicious exploitation | Public disclosures had not established confirmed exploitation as of October 21, 2026 |
| Investigation | MeitY and eMudhra are examining the incident |
Digital Signature Certificates are used in activities such as signing documents, completing online filings and authenticating certain transactions. eSign services enable electronic signing through supported digital processes.
According to the government and eMudhra, these domestic services operate separately from the affected global certificate infrastructure. That separation is why the reported incident has not been described as a compromise of India’s regulated digital-signature system.
The distinction does not mean the incident is unimportant. It means the risk must be assessed according to the specific certificates, systems and services involved rather than assuming that every eMudhra product has been affected.
How Google and Mozilla Responded
Browser providers have acted to reduce the risk associated with the affected certificates.
Google said its Chrome Root Program received a report about the compromised keys on October 17, 2026. It subsequently blocked the affected public keys through a Certificate Revocation List Set update. Google also took steps involving the relevant root certificate in its trust store.
Mozilla separately blocked the affected certificates in Firefox using its OneCRL mechanism and released security updates for certain Firefox and Firefox Extended Support Release versions. These measures help prevent affected certificates from continuing to be trusted by protected software.
The response matters because digital certificate trust is distributed across browsers, operating systems, applications and other software. Blocking a certificate in one environment does not necessarily mean that every device or application has received the same protection immediately.
Google has also warned that removing a root certificate can cause some legitimate certificates associated with that trust chain to stop working. Website operators affected by that change may need to obtain replacement certificates and migrate to another trusted certificate chain.
What CERT-In Has Advised
CERT-In, India’s national cybersecurity agency, published an advisory on October 21 covering the compromise of eMudhra intermediate CA certificates.
The advisory describes the weak-key-generation problem and explains the potential for fraudulent certificate issuance. It also outlines mitigation steps for organisations and administrators that rely on affected certificates or trust stores.
Recommended actions include applying security updates provided by browser and software vendors, checking the status of relevant certificates and following the applicable guidance for affected systems.
Organisations that manage websites, applications or enterprise infrastructure should review vendor advisories and confirm that their systems are using current trust-store information. Website administrators whose certificates chain to an affected authority may need to obtain replacement certificates.
For everyday users, keeping browsers and operating systems updated is an important precaution. Users should remain alert to suspicious links and unexpected requests for credentials, while avoiding unverified social media claims about the incident.
Business Impact and eMudhra’s Response
eMudhra has said the incident is limited to the affected intermediate certificates and does not involve its root CA private keys or other intermediate CAs. The company has also said that its infrastructure was not compromised and that no data breach occurred.
It is investigating the cause of the weak keys and working with affected customers and certificate ecosystem operators on remediation. The company’s statements are relevant to understanding its response, but the final technical assessment depends on the continuing investigation and corroborating evidence.
The incident has also affected market sentiment. eMudhra shares hit the 20% lower circuit on October 21 as investors reacted to reports of the vulnerability and the potential reputational consequences.
The affected global TLS certificate business accounts for approximately 1% of eMudhra’s revenue, according to the company’s disclosures reported by Moneycontrol. That figure provides some context for the direct business exposure, but it does not measure potential legal, operational or reputational costs.
The Bigger Picture
The eMudhra incident highlights how a weakness in a small part of the digital trust infrastructure can create concerns across the wider internet ecosystem. Certificate authorities help browsers establish which websites to trust, making strong key generation, secure operational procedures and prompt incident response essential to online security.
The response from MeitY, CERT-In, Google and Mozilla also illustrates the importance of coordination among regulators, cybersecurity agencies, software providers and certificate operators. Even when the impact on domestic services is limited, investigations are necessary to understand the root cause, confirm remediation and prevent similar weaknesses from recurring. For businesses and users, maintaining updated software and following official security advisories remain practical ways to reduce exposure.
FAQs
1. What is the eMudhra security incident?
The incident involves weak cryptographic private keys associated with eight intermediate digital certificates in eMudhra’s international certificate business. The weakness could potentially allow fraudulent certificates to be created, creating a risk of website impersonation.
2. Are Indian eSign and digital signature services affected?
MeitY and CERT-In have said India’s regulated Digital Signature Certificate and eSign services remain unaffected because the incident concerns a separate international certificate business.
3. What has the IT Ministry done?
MeitY has constituted a special team to investigate the incident and said it is coordinating with relevant operators to assess the situation.
4. Can the vulnerability allow fake websites to appear legitimate?
A compromised intermediate certificate authority’s private key can potentially be used to issue fraudulent certificates. However, public disclosures as of October 21, 2026, did not establish confirmed malicious exploitation of the affected eMudhra keys.
5. What should users and businesses do?
Users should keep their browsers and operating systems updated and follow official security guidance. Businesses and website administrators should check CERT-In and vendor advisories, review certificate chains and replace affected certificates where required.
Looking Ahead
The next stage of the eMudhra incident will focus on the findings of MeitY’s investigation, the company’s root-cause analysis and the completion of remediation across affected systems. The key questions include how the weak keys were generated, whether additional controls need to be strengthened and whether any further impact is identified as the investigation progresses.
For India’s digital ecosystem, the government’s assurance that regulated domestic DSC and eSign services remain unaffected provides important context, but it does not remove the need for vigilance. Organisations should follow official advisories, apply relevant software updates and verify their certificate configurations, while users should rely on confirmed technical information rather than unverified claims about the incident.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
