MeitY Orders Probe Into eMudhra Security Incident

The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate a security incident involving digital trust company eMudhra, while the Indian Computer Emergency Response Team (CERT-In) has issued an advisory outlining protective measures.

As per a report by NDTV Profit, the disruption to Indian websites and applications was limited and short-lived. eMudhra's India-regulated Digital Signature Certificate (DSC) and eSign services remained unaffected.

CERT-In Flags Compromised Keys In Eight Certificates

According to CERT-In, eMudhra reported compromised private keys associated with eight intermediate certification authority certificates within its public key infrastructure.

These included six Transport Layer Security (TLS) certificates and two code-signing certificates.

TLS certificates help secure communications between websites, browsers and applications.

Misuse of compromised keys could potentially enable attackers to create fraudulent certificates, impersonate websites or intercept encrypted communications.

Affected code-signing keys could also pose risks to software authentication.

eMudhra attributed the problem to a technical flaw that generated weak cryptographic keys alongside the original stronger keys.

A security researcher subsequently alerted Apple, Google, Microsoft and Mozilla, warning that the weaker keys might be reconstructed using artificial intelligence-assisted techniques.

The company maintained that its infrastructure was not breached and that no data compromise had occurred.

It said the affected international business contributes approximately 1% of revenue, although reputational consequences remain possible.

Google Blocks Affected Keys

CERT-In said Google had blocked public keys linked to the affected TLS intermediates in Chrome through a Certificate Revocation List Set (CRLSet) update.

Google also announced plans to remove eMudhra's emSign ECC Root CA-G3 from the Chrome Root Store, with implementation scheduled for Oct 27, 2026.

Meanwhile, eMudhra is coordinating with customers to replace potentially affected certificates and working with browser root programmes to investigate the cause.

Government officials said they were also examining whether other operators faced similar vulnerabilities.

They cautioned against exaggerated social media claims while the investigation continues.

Shares of eMudhra fell 20% to ₹432 on Wednesday following reports of the certificate security concerns.