eMudhra: MeitY probes security incident, firm to exit SSL

The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate a security incident involving eMudhra’s global digital certificate infrastructure, DD India reported. The ministry said the impact on Indian websites and applications was limited and short-lived, and that India’s regulated Digital Signature Certificate and eSign services remained unaffected.

The investigation comes as eMudhra moves to withdraw from the affected business. Its board decided on 22 October to exit global SSL/TLS certificate services, Fortune India reported, citing the company’s announcement. These certificates help secure connections between websites and their users.

The incident concerns weak private keys associated with eight intermediate certificate authorities, which occupy a middle layer in the system browsers use to establish whether a website’s certificate can be trusted. Google and Mozilla said they had blocked the affected certificates after receiving a researcher’s report on 17 October 2026.

What the investigation covers

MeitY distinguished between two parts of eMudhra’s operations, according to DD India. Its Digital Signature Certificate and eSign services are regulated by the Controller of Certifying Authorities, an authority under the ministry. Its other business issues digital certificates trusted by browsers and operating systems to secure websites, software and online communications.

The ministry said the reported incident concerned only the second business, which operates internationally under a global trust framework. According to DD India, MeitY said those operations were subject to international standards and independent audits, including WebTrust audits conducted by BDO International Limited, and that the ministry was not involved in auditing them.

The Indian Computer Emergency Response Team, or CERT-In, issued an advisory containing mitigation measures, DD India reported. The ministry said it was coordinating with stakeholders and would share further details after the investigation was completed.

The New Indian Express, reporting PTI’s account, quoted CERT-In as identifying six TLS certificates and two code-signing certificates among the eight affected intermediate certificates. TLS, or Transport Layer Security, protects data moving between browsers, applications and online services; code-signing certificates are used to establish trust in software.

Why weak keys raised a browser-security risk

Google said the affected private keys had been generated with insufficient randomness, making it possible to forge trusted HTTPS certificates for websites an attacker did not control. The risk applied to software that had not yet removed trust in the affected certificate authorities.

Mozilla explained the potential consequence: an attacker able to intercept a user’s connection could use a fraudulent certificate to impersonate a website and potentially read or alter traffic. Neither browser company’s explanation, by itself, establishes that such an attack occurred.

In its published statement, eMudhra said a flaw during its key-generation procedure produced a second, weak set of keys alongside the original strong keys. The weak keys were subsequently published to browser root stores, the collections of certificate authorities that browsers trust.

The company said it had used certified hardware security modules, devices designed to protect cryptographic keys. It attributed the problem to a key-processing step in the procedure rather than the absence of that hardware.

eMudhra said the weakness went undetected for about 18 months and through two independent audit cycles. It also said the exact root cause had not yet been confirmed and that it would publish its findings when the investigation was complete.

What the browser companies blocked

Google said it received the researcher’s report at 18:05 UTC on 17 October and implemented a blocking update at 19:45 UTC. The update targeted the affected public keys, protecting Chrome users against certificates sharing those keys without requiring a browser update or restart.

Mozilla said it received the report at 20:06 UTC that day. By 22:59 UTC, it had completed distribution of a blocking update to Firefox users with standard configurations through OneCRL, its central list of revoked certificates.

Mozilla also released browser updates for users whose custom settings might have prevented receipt of that protection. In an update dated 21 October, it reported an additional Firefox for Android release to fix a problem that prevented some clients from applying changes to the bundled blocklist immediately after startup.

Google identified a further protection for some users: no TLS certificates chaining to the six affected intermediate authorities had appeared in Certificate Transparency records before its blocking action. Certificate Transparency is a public logging system for certificates.

Google therefore said fraudulent certificates from those authorities could not have been used against clients enforcing those logging requirements. It said Chrome applies that requirement to all publicly trusted certificates by default. That finding has a defined scope; it does not establish the same protection for every application or device.

Company response and the wider certificate withdrawal

eMudhra said none of the affected intermediate authorities had issued end-user certificates. It said its infrastructure had not been compromised, no data had been breached, and it knew of no evidence that anyone had recovered or exploited the weak keys before disclosure.

The response nevertheless extends beyond the eight intermediates. Google said it had removed their parent certificate, emSign ECC Root CA – G3, from the Chrome Root Store, with distribution to all devices relying on that store expected on 27 October 2026.

Google warned that some legitimate certificates linked to that root would stop functioning in Chrome as a result. It said eMudhra had committed to helping affected customers migrate to replacement certificates. Google also said it was examining whether eMudhra’s remaining certificate authorities should continue to be included in its root store.

According to Fortune India, eMudhra said global SSL/TLS certificates contributed around 1 per cent of its global revenue. In explaining the board’s withdrawal decision, the company cited rising compliance requirements, operating costs and competition from providers offering certificates free of charge.

The exit is a transition rather than an immediate shutdown. Fortune India reported that eMudhra’s existing G1 RSA roots would continue serving customers until the transition was complete, with replacement certificates offered free through partners. The company said it would maintain revocation and certificate-status services until every issued certificate had expired or been replaced, and would submit a full root-cause report to browser root programmes.