Special team to probe eMudhra incident; impact on Indian websites, applications very limited: Govt

The ministry of electronics and information technology (MeitY) has formed a special team to investigate a security incident at the Bengaluru-based cybersecurity company eMudhra, though its impact on Indian websites and applications was “very limited and for a very short interval.”

The incident involved eight weak cryptographic keys that could potentially have allowed attackers to forge trusted digital certificates and impersonate websites, prompting major technology companies to block the affected certificates.

The vulnerability was reported to browser security teams on October 17, after an independent security researcher found that private keys associated with eight eMudhra intermediate certificates were weak enough to be recovered and potentially misused.


Six affected certificates were linked to website security and two to software signing. The flaw arose during a key-generation process in April 2025, when a defect produced weak keys alongside the intended strong ones, eMudhra said.

The weakness could have allowed attackers to create fraudulent website certificates or make malicious software appear to come from a trusted publisher. The company said the affected certificate authorities had not issued certificates to end-user websites and that its infrastructure had not been breached.

eMudhra provides digital identity, authentication and cybersecurity solutions, including digital signature certificates and services that secure website connections, to businesses and governments in India and overseas.

Apple, Google, Microsoft, and Mozilla have taken steps to block the affected certificates through their respective security systems. Google also plans to remove the emSign ECC Root CA-G3 from Chrome’s trusted list on October 27.

Browsers rely on root certificates to verify the legitimacy of a website. Removing this root could disrupt legitimate websites that continue to rely on the affected certificate chain unless they migrate to another trusted chain.

India’s nodal agency Indian Computer Emergency Response Team (CERT-In) has asked government departments, companies, internet service providers, and website administrators to review their systems. Its advisory calls for browsers and operating systems to be updated, trusted certificate lists refreshed and affected certificates identified and replaced. It has also warned against bypassing browser security alerts.

MeitY said eMudhra’s international website-security business operates under global trust frameworks and undergoes independent audits but is not audited by the ministry. Its Indian Digital Signature Certificate (DSC) and eSign services, regulated by the Controller of Certifying Authorities (CCA), remain unaffected, it said.

“The private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites,” said Subimal Bhattacharjee, an independent cybersecurity analyst.

While Google found no rogue certificates in public Certificate Transparency logs, he warned that some non-browser software could remain vulnerable if it does not check whether certificates have been revoked.

“There has been no comprehensive public confirmation that everything has been removed, all necessary audits have been completed and no residual risk remains,” Bhattacharjee said, calling for independent assessments and random audits of other licensed certifying authorities to check for similar weaknesses.

Vinayak Godse, chief executive of the Data Security Council of India (DSCI), said digital certificates uphold trust across online transactions, making it important to establish the incident’s implications and accountability for the failure.

“Accountability lies with the entity where the problem originates and depends on the responsibility each entity has in the entire chain,” Godse said. He emphasised on the need for interoperability between certificate systems across jurisdictions, with certificates issued in India recognised globally and those issued overseas valid in India.

The company said its affected international website-security business accounts for about 1% of its revenue.

Its shares plunged 20% to Rs.432 on the National Stock Exchange on Wednesday, after the security flaw came to light.