"A security incident concerning eMudhra's Public Key Infrastructure (PKI) was reported in the ...

X • October 21, 2026

Ministry of Electronics & IT @GoI_MeitY A security incident concerning eMudhra’s Public Key Infrastructure (PKI) was reported in the public domain. Meity has taken serious note of the reported incident. A special team has been constituted to investigate the matter. 2:31 PM · Oct 21, 2026 · 34.1K Views 35

Ministry of Electronics & IT @GoI_MeitY 1h However, some social media accounts are indulging in fear mongering the impact of this incident. The facts of the case are as follows: eMudhra operates in two distinct areas: 4 Ministry of Electronics & IT @GoI_MeitY 1h 1. Issuance of Digital Signature Certificates and eSign services, regulated by the Controller of Certifying Authorities (CCA) under MeitY. 2. Issuance of digital certificates trusted by major browsers and operating systems, used to secure websites, 1 Ministry of Electronics & IT @GoI_MeitY 1h software and online communications. The second function is international in nature and operates under global trust framework. It is governed by international standards and subject to independent audits, including WebTrust audits conducted by BDO International Limited. 1 Ministry of Electronics & IT @GoI_MeitY 1h The reported security incident pertains to this only. MeitY is not involved in its audit. The impact of this incident on Indian websites and applications have been very limited and for a very short interval. 2 Ministry of Electronics & IT @GoI_MeitY 1h Meity remains engaged with all the stakeholders to resolve this incident at the earliest. CERT-In has also issued an advisory in r/o the incident including the mitigation measures. Further details will be shared upon completion of the investigation. 1

Cyber Batman @cyb3r_batman 30m We have so many talented pentesters, pls allocate proper budget for bug bounties. Swarms of agents will be unleashed to hack the fk into every nook and corner of our Infra and govt websites in cyber warfare. You know the threats better than me 🙂 Act now. 1

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

eMudhra Security Incident: Weak Keys in Digital Certificates Exposed A security incident involving eMudhra's Public Key Infrastructure (PKI) was reported on October 17, 2026, after researchers discovered weak cryptographic keys in eight intermediate digital certificates. The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the matter, emphasizing that the incident does not affect eMudhra's Digital Signature Certificates (DSCs) and eSign services, which remain unaffected. Major technology companies, including Google, Mozilla, and Apple, have taken steps to block the compromised certificates, with Google planning to remove the associated root certificate from its trust store on October 27. The vulnerability arose from insufficient randomness in key generation, potentially allowing attackers to create fraudulent HTTPS certificates. eMudhra has stated that all affected certificates were revoked on October 19, 2026, and no customer certificates were issued using the compromised keys. The overall impact on Indian websites and applications has been described as very limited and for a short duration. 5 sources 39

Extracted Entities

Companies (3)

CERT-In eMudhra Ministry Of Electronics & IT