MeitY probes eMudhra certificate security incident; CERT-In issues advisory
Synopsis
India's cybersecurity regulators are on alert after eMudhra disclosed that weak cryptographic keys were generated alongside strong ones in its system — compromising 8 PKI certificates and catching the attention of Apple, Google, Microsoft, and Mozilla. MeitY has launched a probe, CERT-In has issued an advisory, and officials stress India's core DSC services are unaffected — but the involvement of global browser vendors means the stakes extend well beyond a 1% revenue line.
Key Takeaways
MeitY has launched a formal investigation into a cybersecurity incident at digital certificate provider eMudhra .
CERT-In reported the compromise of private keys in 8 intermediate CA certificates — 6 TLS and 2 code-signing . eMudhra 's India-regulated Digital Signature Certificate (DSC) and eSign services were reportedly not affected .
The flaw involved the inadvertent generation of weak cryptographic keys , flagged by a researcher who alerted Apple , Google , Microsoft , and Mozilla .
The affected international TLS business accounts for approximately 1% of eMudhra 's revenue; the company says no customer data was compromised.
Officials are reviewing other certificate operators to check for similar vulnerabilities.
The Ministry of Electronics and Information Technology (MeitY) has launched a formal investigation into a cybersecurity incident involving digital certificate provider eMudhra, while the Indian Computer Emergency Response Team (CERT-In) has released a mitigation advisory following the discovery of compromised cryptographic keys. The incident, which surfaced on 21 October 2026, has drawn scrutiny from regulators and major global technology firms alike.
What the Incident Involves
According to CERT-In, eMudhra reported the compromise of private keys linked to eight intermediate certification authority certificates within its public key infrastructure (PKI) — specifically six TLS certificates and two code-signing certificates. TLS certificates are the backbone of secure communications between websites, browsers, and applications; code-signing certificates vouch for the authenticity of software distributed to end users.
The root cause, according to eMudhra, was a flaw in its system that generated weak cryptographic keys alongside the intended strong ones. A security researcher subsequently alerted major technology companies — including Apple, Google, Microsoft, and Mozilla — that these weak keys could potentially be reverse-engineered, reportedly including through AI-assisted techniques.
Scope and Impact on Indian Services
Government sources indicated that the impact on Indian websites and applications was limited and temporary. Critically, eMudhra's India-regulated Digital Signature Certificate (DSC) and eSign services were reportedly not affected. Officials cautioned against exaggerated claims circulating on social media and stated that further details would be shared once the investigation concludes.
eMudhra clarified that the issue is confined to a small segment of its international TLS certificate business, which contributes approximately 1% of its total revenue. The company maintained that its core infrastructure was not breached and that no customer data was compromised, adding that its physical and logical security controls remain intact.
Regulatory Response and Ongoing Checks
MeitY confirmed it is engaging directly with eMudhra on the matter. Officials also indicated that other certificate operators are being reviewed to determine whether similar vulnerabilities exist elsewhere. 'We are taking it up with them, and we are also taking it up with other operators to check whether they have further issues,' an official said in reports.
This is not the first time global PKI infrastructure has faced scrutiny — past incidents involving certificate authorities in other countries led to browser vendors revoking trust in entire CA chains, causing widespread service disruptions. The involvement of Apple, Google, Microsoft, and Mozilla in this case signals that browser-level revocation decisions could follow if the probe surfaces broader concerns.
Security Risks and What Could Go Wrong
Security experts warn that misuse of compromised keys could enable attackers to issue fraudulent certificates for domains they do not control, impersonate legitimate websites, and potentially intercept or alter encrypted communications — a class of attack known as a man-in-the-middle (MITM) attack. Compromised code-signing certificates, meanwhile, could be exploited to distribute malicious software that appears to originate from a trusted source, posing risks to enterprise and consumer systems alike.
With the CERT-In advisory now in circulation and a formal MeitY probe underway, stakeholders in India's digital infrastructure ecosystem — including banks, e-governance platforms, and enterprise software vendors — are expected to conduct internal certificate audits as a precautionary measure. The outcome of the investigation will likely shape how India's PKI governance framework is reviewed going forward.
Point of View
And the regulatory response so far has been measured but reactive. The involvement of Apple, Google, Microsoft, and Mozilla is the real signal here — if any major browser vendor opts to distrust eMudhra's intermediate CAs, the downstream impact on Indian e-governance and banking portals could far exceed the '1% of revenue' framing. MeitY's decision to extend checks to other certificate operators is prudent, but India lacks a real-time certificate transparency monitoring mechanism of the kind that first surfaced this flaw. That gap deserves as much attention as the incident itself.
NationPress
21 Oct 2026
Frequently Asked Questions
What is the eMudhra certificate security incident?
The incident involves the discovery of weak cryptographic keys inadvertently generated by eMudhra's system alongside strong ones, compromising private keys in 8 intermediate CA certificates — 6 TLS and 2 code-signing. A security researcher alerted Apple, Google, Microsoft, and Mozilla that these weak keys could potentially be reverse-engineered, prompting regulatory action in India.
Are India's digital signature and eSign services affected?
According to government sources, eMudhra's India-regulated Digital Signature Certificate (DSC) and eSign services were not affected. The compromised certificates relate to a limited segment of the company's international TLS business, which accounts for roughly 1% of its total revenue.
What action has the government taken?
MeitY has launched a formal investigation into the incident, and CERT-In has issued a mitigation advisory. Officials are also reviewing other certificate operators to determine whether similar vulnerabilities exist elsewhere in India's PKI ecosystem.
What risks do compromised TLS and code-signing certificates pose?
Compromised TLS certificates could allow attackers to issue fraudulent certificates, impersonate legitimate websites, and intercept or alter encrypted communications. Compromised code-signing certificates could be misused to distribute malicious software that appears to come from a trusted source, posing risks to both enterprises and end users.
Has eMudhra confirmed a data breach?
No. eMudhra stated that its infrastructure was not breached and that no customer data was compromised. The company said its physical and logical security controls remain intact and described the issue as affecting only a small portion of its global TLS operations.
