Skip to content
eMudhra Security Incident: Weak Keys in Digital Certificates Exposed

eMudhra Security Incident: Weak Keys in Digital Certificates Exposed

First seen 21 Oct 2026, 15:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 17:09 UTC
  • •Weak cryptographic keys in eight eMudhra certificates were identified, allowing potential forgery of HTTPS certificates.
  • •MeitY confirmed that Digital Signature Certificates and eSign services remain unaffected by the incident.
  • •Major tech companies have blocked the compromised certificates, with Google set to remove the root certificate from its trust store.

A security incident involving eMudhra's Public Key Infrastructure (PKI) was reported on October 17, 2026, after researchers discovered weak cryptographic keys in eight intermediate digital certificates. The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the matter, emphasizing that the incident does not affect eMudhra's Digital Signature Certificates (DSCs) and eSign services, which remain unaffected. Major technology companies, including Google, Mozilla, and Apple, have taken steps to block the compromised certificates, with Google planning to remove the associated root certificate from its trust store on October 27. The vulnerability arose from insufficient randomness in key generation, potentially allowing attackers to create fraudulent HTTPS certificates. eMudhra has stated that all affected certificates were revoked on October 19, 2026, and no customer certificates were issued using the compromised keys. The overall impact on Indian websites and applications has been described as very limited and for a short duration.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-17
Weak keys discovered in eMudhra certificates
Researchers identified vulnerabilities in eight intermediate certificates, leading to concerns over fraudulent certificate creation.
Businesstoday.In
2026-10-19
Revocation of affected certificates
eMudhra revoked all eight compromised intermediate certificates to mitigate the risk of exploitation.
Aninews.In
2026-10-27
Google to remove root certificate
Google plans to remove the associated root certificate from Chrome's trusted list, affecting websites relying on it.
Aninews.In

More articles in this cluster (4)

Following this threat?

Track CERT-In in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 3

Common questions

What services are affected by the eMudhra incident?
The incident affects eMudhra's global website-security business but not its Digital Signature Certificates and eSign services.
What actions are being taken in response to the incident?
MeitY has formed a special team to investigate, and affected certificates have been revoked.
How limited is the impact of this incident?
MeitY stated that the impact on Indian websites and applications has been very limited and for a short duration.