Explained: What is the eMudhra certificate compromise about and should you be worried?

Indian digital certification authority eMudhra has disclosed the compromise of private keys linked to a part of its global certificate business, triggering advisories from CERT-In, action by major browser makers, and a government investigation.

While authorities and the company have said India’s Digital Signature Certificate (DSC) and eSign services remain unaffected, the incident has raised questions about the security of digital certificates that underpin trusted online communications.

Here’s what happened and why it matters.

What is eMudhra?

eMudhra is an Indian digital certification authority that issues digital trust certificates used to verify identities online and secure digital transactions. Its services include DSCs, eSign solutions, and TLS/SSL certificates that help web browsers confirm whether a website is genuine and safe.

TLS (Transport Layer Security) certificates, popularly associated with HTTPS websites, are a set of security protocols that ensure data transmission among digital assets, like browsers and apps, in a secure manner.

Also read: SBI reports cyberattack after nearly 3,900 customer records leaked on dark web

The company operates two distinct businesses:

• An India-focused business providing DSC and eSign services regulated by the Controller of Certifying Authorities (CCA) under the Ministry of Electronics and Information Technology (MeitY).
• A global certificate business that issues TLS, SSL and code-signing certificates used to secure websites, software and online communications.

What is the breach that has been reported?

eMudhra disclosed that private keys linked to eight intermediate Certificate Authority (CA) certificates in its public key infrastructure (PKI) were compromised.

According to CERT-In, the affected certificates include:

• Six TLS certificates used to secure websites and internet communications.
• Two code-signing certificates used to verify software authenticity.

The issue stemmed from weak cryptographic keys that could potentially be reverse-engineered, possibly using AI-assisted techniques.

What are private keys and why do they matter?

Digital certificates rely on a pair of cryptographic keys: A public key and a private key.

The private key is the secret component that proves the identity of a certificate holder. If it is compromised, an attacker could potentially create fake but apparently legitimate certificates.

In simple terms, compromising a private key is similar to stealing the master seal used to authenticate official documents.

How was the vulnerability discovered?

The flaw was reportedly identified by a cybersecurity researcher, who alerted major technology firms including Apple, Google, Microsoft and Mozilla.

Also read: Bank of Baroda hit by cyberattack; hacker leaks 1TB of data on dark web

According to eMudhra, a system flaw created a set of weaker keys alongside the original strong cryptographic keys. These weak keys were subsequently found to be vulnerable to reverse engineering.

Did hackers breach eMudhra’s systems?

eMudhra says no. The company has stated that:

• Its infrastructure was not compromised.
• No customer or company data was breached.
• Physical and logical security controls remained intact.
• The incident relates specifically to weak cryptographic keys rather than an intrusion into the company’s systems.

What risks did the exposed keys create?

CERT-In warned that attackers possessing the compromised private keys could potentially:

• Create fraudulent certificates for domains they do not own.
• Impersonate legitimate websites.
• Launch man-in-the-middle (MitM) attacks by intercepting encrypted communications.
• Issue fraudulent code-signing certificates.
• Create convincing fake payment platforms designed to steal money or personal information.

For example, a malicious actor could potentially create a fake banking or payment website that appears trusted by browsers.

Were any customer-facing certificates misused?

According to eMudhra co-founder Kaushik Srinivasan, the weak keys were never put into commercial use and no certificates were issued using them.

The company has maintained that subscribers were not impacted and that there has been no cybersecurity incident resulting from the vulnerable keys.

How widespread was the problem?

eMudhra says eight of its issuing Certificate Authorities were affected.

Also read: Data breach at Kudankulam plant rings alarm bells on cybersecurity of critical infra

The company also stated that the impacted global TLS certificate business represents about 1 per cent of its overall revenue, suggesting the affected segment is relatively small compared to its broader operations.

Are Indian digital signature services affected?

Authorities and eMudhra say no.

Both MeitY and CERT-In have stressed that:

• DSCs used in India remain unaffected.
• eSign services regulated under India’s certification framework are unaffected.
• The incident is limited to a section of eMudhra’s global certificate business.
• Government sources have described the impact on Indian services as “very limited”.

What action has the government taken?

The MeitY has:

• Constituted a special team to investigate the incident.
• Engaged with stakeholders on mitigation measures.
• Sought further details from eMudhra.
• Push-backed against social media claims that it believes exaggerate the impact of the incident.
• Officials say findings will be shared once the investigation is completed.

What action has CERT-In taken?

The country’s cybersecurity agency, Indian Computer Emergency Response Team (CERT-In), issued an advisory detailing the risks and recommending mitigation measures.

The agency warned that the compromised keys could be used for website impersonation, code-signing abuse and interception of encrypted communications.

How have Google and Mozilla responded?

Major browser vendors have already taken steps to limit potential abuse.

Google has:

• Blocked the public keys of affected TLS intermediates through a Chrome Certificate Revocation List Set (CRLSet) update.
• Announced the removal of eMudhra’s emSign ECC Root CA-G3 from the Chrome Root Store.

Mozilla has:

• Blocked the six affected TLS intermediate certificates.

These measures ensure that browsers no longer trust the affected certificates.

What is eMudhra doing to fix the problem?

The company says it is:

• Replacing certificates for potentially affected customers.
• Working with browser root programmes.
• Conducting a root-cause investigation into how the weak keys were generated.
• Notifying stakeholders and customers about the issue.

The objective is to ensure continuity of services while restoring trust in the affected certificate chain.

Why is this incident significant?

The case highlights the importance of trust infrastructure that underpins the internet.

Also read: 149 million passwords for Gmail, Facebook, Instagram, others leaked online

While there is no evidence so far of customer data being stolen or systems being breached, compromise of certificate authority keys is treated as a serious event because such keys serve as trusted credentials across the web.

Even if no attack occurred, the possibility that attackers could exploit those keys is sufficient for browser makers and regulators to revoke trust and initiate investigations.

What should users do?

For ordinary users, no immediate action is required.

Browsers such as Chrome and Firefox are automatically updating trust stores and revoking affected certificates. However, users should continue following standard cyber hygiene practices:

• Verify website URLs carefully before making payments.
• Avoid clicking suspicious links.
• Keep browsers and devices updated.
• Be wary of websites that request sensitive information unexpectedly.

The bottom line

The eMudhra incident is not a conventional data breach. Instead, it involves the compromise of cryptographic keys used in a small part of the company’s global certificate business. Authorities say India’s digital signature and eSign ecosystem remains unaffected, while browser makers have already revoked trust in the affected certificates. Investigations by MeitY, CERT-In and eMudhra are ongoing, with the central question being how weak keys were generated and whether they were ever exploited in the wild.

(With agency inputs)