India's Ministry of Electronics and Information Technology (MeitY) has taken serious note of the security incident involving eMudhra's digital certificate infrastructure and has constituted a special team to investigate the matter, PTI and ANI reported on Wednesday, October 21.
Source: PTI via Dailyworld
The ministry clarified that Digital Signature Certificates (DSCs) and eSign services regulated in India by the Controller of Certifying Authorities remain completely unaffected, and that the reported incident pertains only to eMudhra's global certificate business, with the impact on Indian websites described as very limited and for a very short interval.
Source: ANI via Devdiscourse
What went wrong
The incident involves eight intermediate certificates issued under eMudhra's global Public Key Infrastructure (PKI). A researcher alerted Google and other technology companies on October 17 that the private keys linked to the certificates had been generated with insufficient randomness, which could potentially have allowed attackers to create fraudulent HTTPS certificates and impersonate legitimate websites, according to Google's Chrome and Android security teams as reported by ANI.
eMudhra said in its statement on Wednesday that a flaw in a key-generation step on April 30, 2025 produced a second, weak set of keys that were published to browser root stores, while its root private key was not compromised. The company said all eight affected intermediate certificates were revoked on October 19, none had issued customer certificates, and no data breach occurred. Google and Mozilla moved to block the affected certificates, and Google plans to remove the associated root certificate from Chrome's trusted list from October 27.
Special MeitY team formed to probe the incident; India's regulated DSC and eSign services unaffected; eight global intermediate certificates revoked on October 19; CERT-In has issued an advisory with mitigation measures.
The ministry also said some social media accounts were indulging in fear-mongering about the incident's impact, and noted that eMudhra's global business operates under a global trust framework with independent audits, including WebTrust audits by BDO. Yaani: the weak keys were in the company's international website-certificate business — the digital signatures Indians use for tax filings and government work run on a separate system and are working normally, the ministry says. Sources: PTI, ANI, YourStory.
Source: YourStory