The Ministry of Electronics and Information Technology has set up a special team to investigate a security incident at eMudhra, while stressing that the impact on Indian websites and applications has been very limited and that regulated Digital Signature Certificate and eSign services remain unaffected.
New Delhi, October 21 — The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate a security incident at eMudhra, after the Indian digital certification company disclosed that private keys associated with some of its certificates had been compromised.
The incident relates mainly to eMudhra’s global digital certificate business, which helps web browsers and operating systems verify that websites, software and online communications are genuine and secure.
MeitY said the impact on Indian websites and applications has been “very limited” and for a very short period.
The government also clarified that eMudhra operates in two separate areas.
The first involves Digital Signature Certificates and eSign services, which are regulated in India by the Controller of Certifying Authorities under MeitY.
The second involves digital certificates trusted by major web browsers and operating systems under a global trust framework.
According to the ministry, the reported security incident concerns only this international certificate business.
This function operates under global standards and is subject to independent audits, including WebTrust audits conducted by BDO International Limited.
MeitY said it is not involved in auditing this international function.
The issue came into focus after cybersecurity watchdog CERT-In issued an advisory regarding the incident.
eMudhra subsequently disclosed that private keys linked to some certificates had been compromised.
Private keys play a critical role in digital certificate infrastructure because they are used to verify trusted digital assets and secure online communications.
A compromise can potentially create risks around the authentication of websites or software if not addressed quickly.
However, MeitY stressed that Digital Signature Certificates and eSign services regulated by the Controller of Certifying Authorities remain completely unaffected.
The ministry also criticised some social-media accounts for what it described as fear-mongering about the scale of the incident.
The special team will now examine the security breach and assess the circumstances surrounding it.
The case highlights the importance of protecting certificate infrastructure because digital certificates form a key layer of trust in online transactions, websites and secure communications.
