The Ministry of Electronics and Information Technology (MeitY) has said a security incident at eMudhra had only a limited and short-lived effect on Indian websites and applications. The incident involved eMudhra’s global digital certificate infrastructure. The ministry has set up a special team to investigate.
In a series of posts on X, MeitY said it had taken serious note of the incident. It said it is working with stakeholders to resolve the matter. The ministry also clarified that eMudhra’s Digital Signature Certificate (DSC) and eSign services remain completely unaffected. These services are regulated by the Controller of Certifying Authorities (CCA) under MeitY.
Two Separate Functions
MeitY explained that eMudhra works in two distinct areas. The first covers digital signature certificates and eSign services, regulated by the CCA. The second covers digital certificates that major browsers and operating systems trust. These secure websites, software and online communications.
The reported incident relates only to the second area. This part operates internationally under a global trust framework. It is subject to independent audits, including WebTrust audits by BDO International Limited. MeitY said it is not involved in auditing this part of eMudhra’s operations.
How the Incident Came to Light
The incident involved eight intermediate digital certificates. They were issued under eMudhra’s global Public Key Infrastructure (PKI), which helps establish trust in digital certificates and secure online connections.
The issue surfaced on 17 October. A researcher alerted Google and other technology companies that the private keys linked to the certificates were vulnerable. Google and Mozilla then moved to block the affected certificates.
eMudhra said it revoked all eight certificates on 19 October. It said none of them had issued customer certificates. The company also said its infrastructure was not compromised and no data breach occurred.
CERT-In Advisory and Next Steps
MeitY said the Indian Computer Emergency Response Team (CERT-In) has issued an advisory on the incident. It includes mitigation measures. The ministry said it will share more details once the investigation is complete. It will keep working with stakeholders to resolve the matter.
