- The Ministry of Electronics and IT formed a team to probe eMudhra's security incident
- CERT-In issued an advisory with mitigation steps after the reported key compromise
- The breach involved eight intermediate certificates in eMudhra's global TLS business
The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate a reported security incident involving eMudhra, while the Indian Computer Emergency Response Team (CERT-In) has issued an advisory detailing mitigation measures.
Government sources told NDTV Profit that the impact on Indian websites and applications was limited and brief, adding that the incident did not affect eMudhra's India-regulated Digital Signature Certificate (DSC) and eSign services.
The Indian Computer Emergency Response Team (CERT-In) has issued an advisory outlining mitigation measures, while the Ministry of Electronics and Information Technology (MeitY) has initiated a probe into the incident.
“We are taking it up with them, and we are also taking it up with other operators to check whether they have further issues,” a government source told NDTV Profit.
ALSO READ: eMudhra Shares Crash 20% After Browsers Move To Distrust Some Of Its Global TLS Certificates
The incident relates to a small part of eMudhra's international Transport Layer Security (TLS) certificate business, rather than its domestic digital signature operations, the company said. Government sources also cautioned against social media claims exaggerating the incident's impact, saying further details would be shared after the investigation is completed.
In its advisory, CERT-In said eMudhra had reported a compromise of private keys associated with eight intermediate certification authority certificates in its public key infrastructure (PKI). These comprise six TLS certificates and two code-signing certificates.
TLS certificates underpin secure connections between websites, browsers and applications. If compromised keys are misused, attackers could potentially issue fraudulent certificates for domains they do not control, impersonate legitimate websites and conduct man-in-the-middle attacks to intercept or modify encrypted communications. Compromised code-signing keys could also be used to issue fraudulent certificates for software.
eMudhra said a flaw in its system led to the creation of weak keys alongside the original strong keys. A researcher alerted Apple, Google, Microsoft and Mozilla that the weak keys could potentially be reverse-engineered, including with AI-assisted techniques.
The company said its infrastructure had not been compromised, no data had been breached, and its physical and logical security controls remained intact. It added that the affected global TLS business accounts for around 1% of its revenue, although the incident could carry reputational risks.
eMudhra is working with potentially affected customers to provide replacement certificates and with root certificate programmes as part of its investigation into the root cause.
ALSO READ: HDFC Bank Says Probe Into Confidential Information Leak Is Underway
CERT-In said Google had blocked the public keys associated with the affected TLS intermediates in Chrome through a Certificate Revocation List Set (CRLSet) update. Google has also announced the removal of eMudhra's emSign ECC Root CA-G3 from the Chrome Root Store. The change is scheduled to reach devices relying on the Chrome Root Store on October 27, 2026.
Shares of eMudhra Ltd. fell 20% to Rs 432 apiece on Wednesday after reports that some of its certificate authorities, used in its global TLS business, were being distrusted. In a statement issued on Wednesday, the Bengaluru-based digital trust company said the matter concerns eight of its intermediate certificate authorities that were trusted as part of its global TLS business.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.