eMudhra Security Incident: MeitY Says Impact on Indian Sites Was 'Limited'
MeitY clarifies that the eMudhra security incident had a limited impact on Indian websites and that DSC and eSign services remain unaffected.
The Ministry of Electronics and Information Technology (MeitY) has stepped in to address concerns regarding a recent eMudhra security incident, clarifying that the disruption to Indian websites and applications was both limited and short-lived. The ministry has constituted a special team to investigate the matter and is working closely with stakeholders to ensure a full resolution.
What Exactly Happened?
The situation came to light on October 17, when a researcher alerted tech giants like Google and other major companies that private keys associated with certain certificates were vulnerable. This vulnerability concerned eight intermediate digital certificates issued under eMudhra's global Public Key Infrastructure (PKI), which is essential for establishing trust in digital certificates and securing online connections.
Following this alert, Google and Mozilla took swift action to block the affected certificates to prevent potential misuse.
Clarifying the Scope: What Was Affected?
To prevent widespread panic, MeitY provided a detailed breakdown of eMudhra's operations, explaining that the company functions in two distinct domains:
- Regulated Services: This includes the issuance of Digital Signature Certificates (DSC) and eSign services. These are regulated by the Controller of Certifying Authorities (CCA) under MeitY. The ministry has explicitly stated that these services remained completely unaffected.
- Global Trust Framework: This involves digital certificates trusted by major operating systems and browsers to secure software, websites, and communications. This segment operates internationally and is subject to independent audits, such as WebTrust audits conducted by BDO International Limited.
MeitY clarified that the security incident was confined solely to the second function—the global trust framework—and noted that the ministry was not involved in auditing this specific part of eMudhra's operations.
eMudhra's Response and Current Status
eMudhra has moved to contain the issue, confirming that all eight affected intermediate certificates were revoked by October 19. Crucially, the company asserted that none of these specific certificates had been used to issue customer certificates.
Furthermore, eMudhra has maintained that its core infrastructure was not compromised and that no data breach occurred during the incident.
Government Action and Next Steps
The Indian Computer Emergency Response Team (CERT-In) has already issued an advisory regarding the incident, providing necessary mitigation measures to safeguard systems.
While the ministry has assured the public that the impact was minimal and temporary, it remains vigilant. MeitY has stated that further details will be disclosed once the ongoing investigation by the special team is complete.