On 21st October (Wednesday), the Ministry of Electronics and Information Technology (MeitY) informed that a special team has been established to look into a security incident involving eMudhra’s Public Key Infrastructure (PKI), taking a “serious note” of the matter. However, the minister assured that its effects on Indian websites and applications have been minimal and transient.
A security incident concerning eMudhra’s Public Key Infrastructure (PKI) was reported in the public domain. Meity has taken serious note of the reported incident. A special team has been constituted to investigate the matter.
— Ministry of Electronics & IT (@GoI_MeitY) October 21, 2026
The ministry advised people not to fall for those engaging in fear-mongering and specified that its Controller of Certifying Authorities (CCA) is responsible for the regulation of the granting of Digital Signature Certificates (DSCs) and eSign services.
1. Issuance of Digital Signature Certificates and eSign services, regulated by the Controller of Certifying Authorities (CCA) under MeitY. 2. Issuance of digital certificates trusted by major browsers and operating systems, used to secure websites,
— Ministry of Electronics & IT (@GoI_MeitY) October 21, 2026
However, the global trust framework governs the issuance of digital certificates that are trusted by popular operating systems and browsers as well as serve to safeguard websites, software, and online communications, referring to the function as “international in nature.”
The ministry added that it “is governed by international standards and subject to independent audits, including WebTrust audits conducted by BDO International Limited.” It mentioned that the development is exclusively about this and “MeitY is not involved in its audit. The impact of this incident on Indian websites and applications has been very limited and for a very short interval.”
The reported security incident pertains to this only. MeitY is not involved in its audit. The impact of this incident on Indian websites and applications have been very limited and for a very short interval.
— Ministry of Electronics & IT (@GoI_MeitY) October 21, 2026
MeitY emphasised that it is actively engaged with all stakeholders to bring about the earliest possible resolution to this incident, outlining, “CERT-In (Indian Computer Emergency Response Team) has also issued an advisory in r/o the incident, including the mitigation measures.”
It stated that more details will be provided after the inquiry is completed and noted that “Digital Signature Certificates and eSign services regulated by CCA remain completely unaffected by this incident.”
Further details will be shared upon completion of the investigation. Important to note that Digital Signature Certificates and eSign services regulated by CCA, remains completely unaffected by this incident.
— Ministry of Electronics & IT (@GoI_MeitY) October 21, 2026
According to CERT-In’s advisory, eMudhra revealed that 8 intermediate Certification Authority (CA) certificates in its public key infrastructure (PKI) had their private keys accessed. These included two code-signing certificates and 6 Transport Layer Security (TLS) certificates.
TLS protocols aid in the safe transfer of data between browsers, applications, and websites while digital certificates foster trust in online assets. To secure digital communications, encryption and other security procedures require both private and public keys.
CERT-In cautioned that hackers might exploit the stolen keys to create fake certificates for domains they don’t control. The malicious actors could be able to intercept or alter encrypted communications via such TLS credentials to pose as trustworthy websites and enable man-in-the-middle (MitM) attacks. Additionally, counterfeit code-signing certificates could be generated leveraging the compromised code-signing keys.
Why Google, Mozilla and other browsers blocked eMudhra certificates
On 17th October, it was revealed that 8 (of multiple) eMudhra Global TLS intermediate CAs had cryptographically weak keys. These were not produced with appropriate randomness, rendering them relatively easy to decipher. 2 of these certificates were employed for digitally signing software, and the other 6 were intended for website authentication. Wayne, an independent security researcher, found the risk and flagged it to browser firms.
The administration of digital certificates relies heavily on cryptographic keys. A private key is utilised to verify the identity of an organisation, like a website or software publisher, and is designed to stay confidential. Hence, these must possess significant unpredictability to prevent them from being anticipated or reconstructed by outsiders.
The vulnerability allowed attackers to likely redevelop the private keys linked to the impacted intermediate authorities in just a couple of seconds. This could help them to spoof websites, provide counterfeit certificates that look authentic, or present dangerous software as reliable.
Meanwhile, the following day, all eight intermediates were revoked. Furthermore, no certificates were issued. There was neither a data breach nor an infrastructure compromise. Its physical and logical security controls also continued to be intact. These intermediates are found under eMudhra’s ECC root, which was distrusted by browser root programs due to the occurrence.
As a result, Mozilla blocked the affected website-certification keys in Firefox using its centralised certificate revocation system and released an updated version to offer this protection to the individuals whose custom settings would have prevented the prior upgrade.
Mozilla is also revising the trusted certificate list to delete the root certificate that signed the targeted intermediates, which will protect the other applications that have its trust store but do not receive the latest modifications.
Google also did the same with a Certificate Revocation List Set (CRLSet) update. Users were not required to upgrade or restart their browsers to implement these precautions. Additionally, Google has declared that eMudhra’s emSign ECC Root CA-G3 will no longer be available in the Chrome Root Store.
The update is set to take effect on 27th October for all devices that depend on the Chrome Root Store. Apple and Microsoft also took action against the corrupted certificates.
Government sources explained that eMudhra runs both a global certificate business and distinct Indian services, such as eSign, and the problem is related to its international operations, the Times of India reported. “We are taking it up with them, and we are also taking it up with other operators to check whether they have further issues,” an insider disclosed.
The event sparked concerns about the internet’s overall security, which depends on a system of trust between browsers and certificate validation to secure online communications and authenticate websites. It could be undermined by a failure at even one certification authority, allowing hackers to fabricate digital certificates, masquerade as genuine websites and intercept private data.
eMudhra’s response to the certificate trust scare
According to eMudhra’s official website, the security challenge involves a particular set of intermediate CA certificates made as part of a Key Generation Ceremony (KGC) held in April of last year within its public trust infrastructure. The hierarchy was included in browser trust lists in the middle of May and concluded two separate audit cycles.
It underscored, “The incident is limited to these specific intermediate CA certificates and does not affect eMudhra’s root CA private keys or other intermediate CAs.”
The company pointed out that, except for one, none of these CAs was deployed in production. Moreover, no end-entity certificates have been supplied by any of these intermediate CAs. It mentioned, “To the best of our knowledge, no other roots or intermediates were generated using the flawed process. Seven of the eight intermediates were never used in production. The one that was in production had not issued a single certificate.”
It also stressed, “This has been confirmed through our internal analysis and corroborated by publicly available Certificate Transparency records on crt.sh.”
It stated, “The issue went undetected for about 18 months, through two independent audit cycles. The researcher was able to reverse-engineer the weak keys, reportedly with the help of AI-assisted tooling. We have not yet confirmed the exact root cause. We will publish it in full once our investigation is complete. We are not aware of any evidence that the weak keys were recovered or exploited by anyone before the issue was disclosed.”
When eMudhra became aware of the situation, it activated its response protocols, carried out steps to contain the exposed certificates, and began cooperating closely with browser and root-store operators to shield users and the overall integrity of the WebPKI ecosystem.
It added, “We are conducting a thorough investigation into the circumstances surrounding the incident and reviewing our security controls and operational procedures to identify and implement any necessary improvements. The security and integrity of our trust services remain our highest priority. We are committed to transparency, adherence to industry standards, and continued collaboration with the global WebPKI community.”
eMudhra asserted the instance only had a minor effect on its global TLS business, amounting to 1% of its revenue, and had nothing to do with its eSign and Indian DSC services. It clarified that the withdrawal of Root CAs C1 and C3 with Mozilla was a planned, voluntary action unrelated to the current scenario.
The company submitted that the consequences are confined to a single customer ecosystem in the United States and are restricted to TLS certificates chaining to the rogue ECC root. It informed, “Certificates from that hierarchy are being replaced, and we are working directly with this customer on a transition plan. The majority of TLS certificates we have issued are unaffected, because they chain to other trusted hierarchies.”
eMudhra is providing new certificates from a separate, independently run, publicly trusted CA hierarchy to the targeted client ecosystem, concluding, “We have notified affected customers and partners directly. We are also making sure every customer knows exactly what is and is not affected: all of our enterprise applications, the majority of our TLS certificates, and all of our digital signature and eSign services remain unaffected.”
What is eMudhra
eMudhra, headquartered in Bengaluru, was launched in 2008 and is one of India’s top digital identification and security firms. It offers electronic signing, digital signature certificates, and technology to secure digital transactions and authenticate online identities. It is the biggest certifying body for digital signature certificates in India.
eMudhra referenced a 2024 Frost & Sullivan study to support its May 2026 investor presentation, which suggested that it held about 38% of the market by value. It supports corporations, financial institutions, and governmental bodies in more than 35 countries.
Organisations recognised as certification authorities are in charge of distributing digital certificates that affirm the legitimacy of websites, people or other companies. These certificates are a component of the PKI of the internet, which enables safe communication and verification of identities between users and computer systems.
A hierarchy comprising trusted root authorities, intermediate authorities, and certificates issued to websites or other end users is applied to issue them. According to the Information Technology Act of 2000, the CCA hands out licenses to such entities to supply digital signature certificates.
