eMudhra shares crash over 35% in two trading sessions. Here's why

The Ministry of Electronics and Information Technology (MeitY) said the incident had a limited, short-lived impact on Indian websites and applications, and has set up a special team to investigate. In a series of posts on X, the ministry said it had taken serious note of the matter and was working with stakeholders to resolve it. eMudhra’s Digital Signature Certificate (DSC) and eSign services, regulated by the Controller of Certifying Authorities (CCA) under MeitY, remain unaffected, it said.

“The impact of this incident on Indian websites and applications has been very limited and for a very short interval,” the ministry said. MeitY said eMudhra operates in two distinct areas: CCA-regulated digital signature and eSign services, and digital certificates trusted by major browsers and operating systems to secure websites, software and online communications. The incident relates only to the second function, which operates internationally under a global trust framework and is subject to independent audits, including WebTrust audits by BDO International.

MeitY said it does not audit this part of eMudhra’s operations. The eight affected certificates were issued under eMudhra’s global Public Key Infrastructure (PKI), which establishes trust in digital certificates and secures online connections. MC Explainer: What went wrong with eMudhra's security certificates and why it matters? The issue surfaced on October 17, when a researcher alerted Google and other technology companies that private keys linked to the certificates were vulnerable.

Google and Mozilla then moved to block them. eMudhra said all eight certificates were revoked on October 19 and none had issued customer certificates. Its infrastructure was not compromised and no data breach occurred, the company said. CERT-In has issued an advisory with mitigation measures. MeitY said it would share further details once the investigation is complete. Company says no customer impact

eMudhra co-founder Kaushik Srinivasan told PTI that the weak keys were never put to commercial use, so the vulnerability did not lead to any cybersecurity incident. “There’s no impact to subscribers because we have done all the actions,” he said. The flaw does not affect the company’s India digital signature or enterprise solutions businesses, he added.