MeitY Forms Special Team to Probe eMudhra Certificate Security Incident
MeitY forms a special team to investigate a security flaw in eMudhra's global certificates after Google and Mozilla blocked them.
The Ministry of Electronics and Information Technology (MeitY) has established a special investigation team to look into a security incident involving the digital certificate infrastructure of eMudhra. The move comes after global technology giants blocked several certificates due to critical security vulnerabilities that could have compromised online safety.
What Triggered the Investigation?
The crisis unfolded on October 17, when a security researcher alerted Google and other major tech firms about a vulnerability in eight intermediate digital certificates. These certificates are part of eMudhra's global Public Key Infrastructure (PKI), which is essential for verifying website identities and ensuring secure internet connections.
According to the security teams at Google Chrome and Android, the private keys for these certificates were generated with insufficient randomness. This flaw created a significant risk, as it could have potentially allowed malicious actors to create fraudulent HTTPS certificates and impersonate legitimate websites, leading users into traps.
Global Tech Giants Take Action
In response to the discovery, Google and Mozilla acted swiftly to block the affected certificates. Google further announced that starting October 27, it would remove the associated root certificate from the trusted list in Chrome, which may impact websites that continue to rely on it.
Is India's Digital Infrastructure Safe?
Despite the global alarm, MeitY sources have provided crucial clarifications to reassure the public and businesses in India:
- Limited Impact: The incident is confined to eMudhra's international digital certificate business, which operates under a global trust framework and undergoes independent WebTrust audits by BDO International Limited.
- DSC and eSign Safe: The Digital Signature Certificates (DSCs) and eSign services regulated within India—which are overseen by the Controller of Certifying Authorities under MeitY—operate on entirely separate infrastructure and remain completely unaffected.
- Short Duration: Sources stated that the impact on Indian websites and applications was very limited and lasted for only a short interval.
eMudhra's Explanation of the Flaw
Bengaluru-based eMudhra, a listed cybersecurity and digital identity firm, issued an official statement acknowledging a technical failure. The company revealed that a flaw during a key-generation process on April 30, 2025, led to the publication of weak cryptographic keys.
The company explained that a glitch in the Key Generation Center (KGC) caused a "wrap/unwrap" step to produce a second set of weak keys alongside the original strong ones, and it was these weak keys that were published to the browser root stores.
Damage Control and Revenue Impact
eMudhra has maintained that its core infrastructure was not compromised and no data breach occurred. The company confirmed that all eight affected intermediate certificates were revoked by October 19 and noted that none of these certificates had been used to issue customer certificates.
Financially, the company stated that the global TLS business accounts for approximately 1 per cent of its total revenue. However, it admitted that the incident could lead to unquantifiable reputational risks.
Current Status and Mitigation
The Indian Computer Emergency Response Team (CERT-In) has already issued an advisory detailing the necessary mitigation measures to handle the situation. MeitY continues to work closely with all stakeholders to resolve the issue, with further details expected once the special team completes its full investigation.