New Delhi, October 22, 2026: The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate a security incident involving eMudhra’s digital certificate infrastructure after major browser companies moved to block affected certificates. The government has said the impact on Indian websites and applications was very limited and short-lived.
The issue involves a small set of intermediate digital certificates used in eMudhra’s international Public Key Infrastructure business, which helps browsers verify the identity of websites and establish secure HTTPS connections.
MeitY Sets Up Special Investigation Team
MeitY said it has taken the incident seriously and constituted a dedicated team to examine what happened, how the weak certificates were generated and whether additional corrective measures are required.
The ministry is also coordinating with eMudhra, CERT-In and other stakeholders as the investigation continues.
Eight Intermediate Certificates Affected
The security issue concerns eight intermediate Certification Authority certificates associated with eMudhra’s global certificate infrastructure.
These certificates form part of the trust chain that allows browsers and operating systems to decide whether a website certificate should be treated as genuine.
Weak Cryptographic Keys Triggered Concern
According to CERT-In and Google, the private keys associated with the affected certificates were generated with insufficient cryptographic randomness.
CERT-In said the P-384 elliptic-curve private keys had unusually small values, making them easy to recover from corresponding public keys and potentially allowing forged certificates to be created.
Google and Mozilla Block Affected Certificates
After the weakness was reported, Google moved quickly to block the affected certificate keys for Chrome users.
Mozilla also blocked the certificates in Firefox using its revocation system. These actions were intended to prevent the weak certificates from being used to impersonate legitimate websites.
Risk Involved Fake Trusted Websites
The biggest theoretical risk from the flaw was that an attacker could forge HTTPS certificates that appeared to be legitimate.
Such certificates could potentially be used to impersonate trusted websites on systems that continued to trust the compromised certificate authorities.
Indian eSign and Digital Signature Services Unaffected
The government has stressed that eMudhra’s Digital Signature Certificate and eSign services regulated in India were not affected.
Those services operate separately from the company’s international website-certificate business involved in the incident.
Impact on Indian Websites Called ‘Very Limited’
MeitY said the impact on Indian websites and applications was very limited and existed only for a short period.
The ministry also cautioned against exaggerated claims circulating online about the scale of the incident.
eMudhra Says No Customer Certificates Were Issued
eMudhra has said the eight affected intermediate certificates had not issued customer certificates.
The company also maintained that its core infrastructure was not compromised and that the incident resulted from a flaw in a key-generation process rather than a conventional external hack.
Flaw Traced to April 2025 Key Generation
According to eMudhra, the issue originated during a key-generation process carried out on April 30, 2025.
The company said a flaw in the process generated a second set of weak keys alongside the intended strong keys, and those weak keys were the ones subsequently published to browser trust stores.
All Eight Certificates Revoked
eMudhra said all eight affected intermediate certificates were revoked on October 19, 2026.
Browser operators have also taken additional measures to prevent the certificates from being trusted.
CERT-In Issues Mitigation Advisory
India’s cybersecurity agency CERT-In has issued an advisory detailing the affected certificates and mitigation steps.
The agency clarified that the incident concerns eMudhra’s international certificate business and does not affect its domestic digital-signature and eSign services.
Google Plans Further Trust-Store Action
Google has said it plans to remove the associated eMudhra root certificate from Chrome’s trusted certificate store beginning October 27.
Legitimate websites still relying on certificate chains linked to that root may need to migrate to another trusted certificate hierarchy to avoid browser warnings.
Investigation Continues
MeitY’s special team will now examine the root cause, assess the effectiveness of remedial measures and determine whether any additional regulatory or technical action is required.
Further details are expected after the government completes its investigation.
Source: MeitY, CERT-In, Google Chrome Security, eMudhra
Supreme News Network
