Explainer: The trust crisis in eMudhra’s digital certificate business

These authorities are part of its international business of issuing digital certificates used by browsers and operating systems to establish trust in websites and secure online communications. Researchers found that the keys could be recovered almost instantly, potentially allowing an attacker to create fraudulent certificates and impersonate legitimate websites. THE COMPANY OPERATES in two distinct areas.

In India, it provides digital signature certificates (DSCs) and eSign services used by individuals and businesses to authenticate documents and complete electronic transactions. Its international business issues digital certificates that help browsers verify the identity of websites and establish secure connections. These certificates underpin the HTTPS protocol used by websites, including banks, e-commerce platforms and government portals.

The distinction matters because the current incident concerns the international website-security business, not the domestic digital-signature services. The company says the two operate on separate infrastructure. What are cryptographic keys? CRYPTOGRAPHIC KEYS ARE strings of data used to secure information and establish digital identities. A private key is kept secret and is used for operations such as signing a digital certificate, while the corresponding public key can be shared to verify it.

The system relies on private keys being sufficiently difficult to calculate. In eMudhra's case, a flaw during a key-generation exercise in April 2025 created a second set of weak keys alongside the intended strong keys. The weak keys were subsequently published to browser trust systems. A CERTIFICATION AUTHORITY is a trust-ed identity-verification agency for the internet. When a browser connects to a website, its digital certificate helps establish that the site is genuine and enables an encrypted connection.

If an attacker obtains the private key of a trusted certification authority, he could issue fake certificates for domains it does not control. These could be used to impersonate legitimate websites or facilitate interception and modification of communications under certain conditions. As per CERT-In, the problem arose from insufficient randomness during key generation, rather than a weakness in the underlying cryptographic algorithm.

What has the government said? THE MINISTRY OF electronics and information technology (MeitY) has constituted a special team to investigate the incident and determine how the vulnerability arose. It said the impact on Indian websites and applications was very limited and for a very short interval. It clarified that eMudhra’s domestic digital-signature certificate and eSign services remain unaffected.

These services are regulated by the Controller of Certifying Authorities (CCA) under MeitY. The ministry drew a distinction between these domestic services and the company's international website-security business, which operates under a separate trust framework and is subject to international standards and independent audits. What has eMudhra said in its defence? EMUDHRA HAS SAID its infrastructure was not compromised, no data was breached and its security controls are intact.

Co-founder Kaushik Srinivasan said the vulnerable keys were created but not put to commercial use. None of the eight affected intermediate authorities issued certificates to end-user websites or software. It is investigating the root cause and working with browser operators and affected customers to replace certificates where necessary. Why did Google & Mozilla take action? BROWSER COMPANIES HAVE to protect users against potential threats.

Google blocked the affected certificate keys in Chrome and announced plans to remove a related root certificate from its trust store from October 27. Mozilla blocked the affected certificates in Firefox. Such measures prevent the compromised keys from being trusted for new connections, but removing a root certificate can also affect legitimate websites that depend on it. What happens next? THE PROBE MUST find out how the weak keys were generated, why they entered browser trust systems and whether existing controls were adequate to detect the flaw.

The incident also raises questions about oversight of certification authorities, whose security failures can have consequences beyond their immediate clients. eMudhra, meanwhile, has decided to exit the global website authentication certificate business.