eMudhra security incident: What went wrong with its digital certificates and why MeitY is investigating

India’s IT ministry has set up a special team to investigate a security lapse involving eight intermediate certificate authorities linked to eMudhra’s global operations. While Google and Mozilla have moved to block the affected certificates, the government says the impact on Indian websites was limited and regulated digital signature services remain unaffected.

A flaw in the generation of cryptographic keys used by eMudhra’s global security infrastructure has prompted an investigation by India’s Ministry of Electronics and Information Technology (MeitY), alongside protective measures by major browser makers. The incident raises concerns a system that underpins trust in websites and software distributed over the internet.

The government has sought to distinguish the affected infrastructure from eMudhra’s domestic digital signature services, which it says continue to operate without disruption. It has also pushed back against claims circulating on social media the scale of the incident, saying its effect on Indian websites and applications was limited and brief.

MeitY has constituted a special team to examine what happened, while the Indian Computer Emergency Response Team (CERT-In) has issued an advisory outlining mitigation measures. The ministry said further information would be released once the investigation is complete.

How a flaw in certificate generation can threaten online trust

The incident centres on eight intermediate certificate authorities associated with eMudhra’s international business. According to the company’s disclosures, the problem originated during a key-generation ceremony on April 30, 2025. A flaw in the process led to weak cryptographic keys being generated alongside the intended stronger keys.

To understand the implications, it helps to look at how digital certificates work. When someone visits a website using HTTPS, their browser checks its digital certificate to establish whether the site can be trusted and to help set up an encrypted connection. These certificates are issued through a hierarchy of trusted certificate authorities, which use cryptographic keys to sign certificates and establish their authenticity.

Intermediate certificate authorities sit between a root authority and the certificates issued to individual websites or software publishers. If an intermediate authority’s cryptographic keys are compromised or inadequately protected, an attacker could potentially exploit them to create fraudulent certificates that appear legitimate.

Such certificates could, in theory, be used to impersonate a genuine website or misrepresent the publisher of a software application. That does not mean such attacks occurred in this case. The available disclosures identify a weakness in key generation, but do not establish that attackers used the affected keys to conduct impersonation.

The affected authorities were involved in eMudhra’s global Transport Layer Security (TLS) and code-signing operations. TLS certificates help browsers authenticate websites, while code-signing certificates allow operating systems and other software to verify a publisher’s identity and check whether signed code has been altered.

eMudhra said the process used certified security modules to generate the keys and that it is investigating the underlying cause of the failure.

Why Google and Mozilla intervened, and what remains unaffected

The issue came to Google’s attention on October 17, 2026, when a security researcher reported the affected intermediate authorities to the Chrome browser security team. Google subsequently blocked the intermediates, preventing Chrome from continuing to trust them in the affected certificate chains.

Google said its checks found no TLS certificates linked to six of the affected website-certificate intermediates in Certificate Transparency logs before the blocking action. These logs maintain publicly auditable records of issued TLS certificates, helping security researchers and browser operators detect suspicious or unauthorised issuance.

The finding offers some reassurance regarding those six intermediates, but it should not be interpreted as proof that every aspect of the incident has been resolved or that no misuse was possible. The disclosures cited do not establish that fraudulent certificates were issued using the weak keys.

Mozilla has also taken steps to block the affected certificates in Firefox following the report received on 17 October. Such action matters because browsers maintain lists of trusted certificate authorities and can withdraw that trust when a security concern emerges.

MeitY, meanwhile, said the incident relates to eMudhra’s international operations, which function within a global trust framework governed by international standards and independent audits. The ministry clarified that it does not oversee audits of that part of the business.

India’s regulated Digital Signature Certificate (DSC) and eSign services, overseen by the Controller of Certifying Authorities (CCA), remain unaffected, according to the government. These services are used for digital authentication and electronic signing, including in online transactions and official processes.

The distinction is important: the reported weakness concerns specific intermediate authorities used in international TLS and code-signing operations, rather than evidence of a failure across all eMudhra services.

The investigation will need to establish how the key-generation flaw occurred and whether any further risks remain. For now, browser-level blocking, CERT-In’s mitigation advisory and the government’s ongoing coordination with stakeholders form the immediate response. MeitY has said it will additional details after its inquiry concludes.

emudhra security incident what went wrong with its digital certificates and why meity is investigating

Tesla aims to sell Cybercab robotaxis by end of year despite federal probe

Cloudflare sees millions of exploit attempts after PHP disclosure

Sam Altman says AI could help discover a cure for a major disease within two years

X’s Community Notes missed 93% of false US midterm election claims: Study

Meta sued in Australia over alleged harm caused to children on , Instagram