MeitY has set up a special investigation team after a key‑generation ceremony on 30 April 2025 produced weak cryptographic keys for eight of eMudhra’s intermediate authorities. The flaw could have let attackers issue fraudulent TLS certificates, but the ministry says the damage was brief and limited. Digital Signature Certificate and eSign services, regulated by the Controller of Certifying Authorities, remain untouched. The incident sparked concern when the flaw was flagged by a security researcher on 17 October 2026.
eMudhra supplies certificates trusted by browsers and operating systems, and its TLS certificates help sites authenticate and secure data streams. The weak keys arose during a key‑generation ceremony that used certified security modules but suffered a process flaw, generating both strong and weak keys.
Google’s Chrome team received the researcher report and blocked the affected intermediates, while Mozilla’s Firefox followed suit after the same notification. No TLS certificates chaining to the six affected intermediates had appeared in Certificate Transparency logs before the blocks, according to eMudhra.
MeitY said it has issued an advisory through CERT‑In and is coordinating with stakeholders to address the issue. The ministry stressed that its role is limited to regulated digital signatures, not the global trust framework, and that the incident pertains only to the latter.
Rohit Kumar, a small‑business owner in Bengaluru, relies on eSign to file invoices and said he was relieved to hear the services were unaffected, though he watches the situation closely.
The investigation will conclude before the end of the month, with MeitY promising to release detailed findings once the probe is complete.