The Centre has formed a special team to investigate a security incident at eMudhra, the digital certification giant, after the firm disclosed that private keys for eight intermediate certificates were compromised. MeitY issued a sharp statement on the matter, insisting the impact on Indian websites and applications is “very limited” and confined to a short interval. The ministry explicitly distanced the incident from domestic operations, noting that Digital Signature Certificates and eSign services regulated by the Controller of Certifying Authorities (CCA) remain completely untouched.
The breach, however, stung the company’s global profile. eMudhra revealed that a system flaw created a set of weak keys alongside the original strong ones, allowing researchers to reverse-engineer them—possibly using AI-assisted techniques. This wasn't an infrastructure hack. No data was breached, and physical security controls held firm. The problem was mathematical, not physical, affecting the public key infrastructure (PKI) that secures global web communications.
Global browsers reacted swiftly. Google blocked the public keys of the affected TLS intermediates in Chrome via a Certificate Revocation List Set update. Mozilla followed suit, blocking the six affected TLS intermediate certificates. eMudhra, which stated the affected global TLS business accounts for only 1% of its revenue, is now working directly with customers to issue replacement certificates. The company is also continuing its root-cause investigation alongside root programmes.
MeitY did not miss the chance to push back against public panic. The IT ministry accused specific social media accounts of “indulging in fear-mongering” over the incident, which it emphasized pertains to eMudhra’s international function governed by global standards like WebTrust audits by BDO International Limited. “The impact... has been very limited,” the ministry reiterated, urging stakeholders to rely on official advisories over viral speculation.
The next step is clear: MeitY is engaged with all stakeholders to resolve the matter at the earliest. Further details on the specific vector of the key weakness and the full scope of the investigation will be shared only once the special team completes its probe. For now, the digital trust chain is being repaired, key by key.