The government has launched an investigation into weak cryptographic keys linked to eMudhra certificates, while the company says the impact on Indian websites and applications was limited and short-lived.
Highlights
- MeitY has formed a special team to investigate the security incident involving Bengaluru-based eMudhra.
- Eight weak cryptographic keys potentially allowed attackers to forge trusted digital certificates.
- The vulnerability was reported to browser security teams on October 17.
- Six affected certificates were linked to website security, while two were used for software signing.
MeitY Launches Investigation into eMudhra Cryptographic Key Security Lapse
New Delhi, October 22: The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate a cybersecurity incident involving Bengaluru-based digital identity and cybersecurity company eMudhra.
The incident involved weak cryptographic keys that could potentially have allowed cybercriminals to create fraudulent digital certificates and impersonate legitimate websites.
However, eMudhra maintained that the impact on Indian websites and applications was very limited and lasted for a short period.
Eight Weak Cryptographic Keys Identified
According to the report, the vulnerability involved eight eMudhra intermediate certificates associated with weak cryptographic keys.
The issue was reported to browser security teams on October 17 after an independent security researcher discovered that the private keys linked to these certificates were weak enough to be recovered and potentially misused.
Six of the affected certificates were related to website security, while two were associated with software signing.
The weakness originated during a key-generation process in April 2025, when a defect resulted in weak keys being produced alongside the intended strong keys.
Google, Apple and Microsoft Take Action
Major technology companies, including Google, Apple, Microsoft and Mozilla, have taken measures to block the affected certificates through their respective security systems.
Google also plans to remove the emSign ECC Root CA-G3 certificate from Chrome’s trusted certificate list on October 27.
Root certificates are used by web browsers to verify the authenticity of websites and establish secure connections.
Removing the affected root certificate could disrupt legitimate websites that continue using the certificate chain unless they migrate to another trusted provider.
eMudhra Says Infrastructure Was Not Breached
eMudhra clarified that the affected certificate authorities had not issued certificates directly to end-user websites.
The company also maintained that its infrastructure had not been breached.
According to eMudhra, the vulnerability could potentially have enabled attackers to forge trusted certificates or make malicious software appear to originate from a legitimate publisher.
The company provides digital identity, authentication and cybersecurity solutions, including digital signature certificates and services used to secure website connections.
CERT-In Issues Security Advisory
India’s nodal cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has advised government departments, businesses, internet service providers and website administrators to review their systems.
The advisory recommends updating browsers and operating systems, refreshing trusted certificate lists, and identifying and replacing affected certificates.
CERT-In has also warned organisations against bypassing browser security alerts, as doing so could expose users to additional cyber threats.
Indian Digital Signature Services Remain Unaffected
MeitY said eMudhra’s international website-security operations function under global trust frameworks and undergo independent audits that are not conducted by the ministry.
However, the company’s Indian Digital Signature Certificate (DSC) and eSign services, regulated by the Controller of Certifying Authorities (CCA), remain unaffected.
The government’s investigation will examine the circumstances surrounding the cryptographic key weakness and its potential security implications.
The incident highlights the importance of strong encryption standards, secure certificate generation and regular cybersecurity audits in protecting digital infrastructure.
