The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate a security incident involving eMudhra’s global Public Key Infrastructure (PKI).
The incident concerns eight intermediate Certificate Authority (CA) certificates associated with eMudhra’s international digital certificate business. According to the Indian Computer Emergency Response Team (CERT-In), weaknesses in the generation of the associated private keys made them recoverable from their corresponding public keys.
Editorial Insight
Key Highlights
Important points readers should notice.
MeitY has formed a special team to investigate the eMudhra security incident.
The incident involves eight intermediate digital certificate authorities associated with eMudhra’s global operations.
MeitY described the impact on Indian websites and applications as limited and brief.
Domestic DSC and eSign services regulated by the CCA remain unaffected.
CERT-In has issued an advisory detailing the risks and mitigation measures.
MeitY said the impact on Indian websites and applications was very limited and lasted for a short period. The Ministry clarified that Digital Signature Certificate (DSC) and eSign services regulated by the Controller of Certifying Authorities (CCA) remain unaffected.
The incident relates to eMudhra’s international certificate operations, which issue digital certificates trusted by browsers and operating systems to secure websites, software and online communications. These operations function under a global trust framework and are subject to international standards and independent audits.
CERT-In issued an advisory on October 21 outlining the technical risks and mitigation measures. It warned that compromised certificate keys could potentially be used to issue fraudulent certificates, impersonate legitimate websites or facilitate the interception of encrypted communications under certain conditions.
Editorial Analysis
Why This Matters
Digital certificates help browsers and operating systems verify online identities and establish secure connections. A compromise involving certificate authorities can create risks of website impersonation and misuse of digital trust systems.
MeitY said it was coordinating with stakeholders to address the incident. The investigation is expected to establish further details about the circumstances and implications of the security issue.
