Government takes a strict stance on the eMudhra security issue; a special team has been formed to conduct an investigation..
Following a security-related incident at eMudhra, the Ministry of Electronics and Information Technology (MeitY) has taken the matter seriously and has constituted a special team to investigate it. The Ministry has clarified that the impact of this incident on Indian websites and apps was limited to a very short duration. Meanwhile, addressing concerns circulating on social media, the government has stated that eMudhra’s Digital Signature Certificate (DSC) and eSign services remain completely secure.
What is eMudhra?
eMudhra is a prominent, licensed Certifying Authority in India. It issues Digital Signature Certificates (DSC), eSign services, and SSL/TLS security certificates for websites. eMudhra primarily provides two types of services. The first relates to the issuance of Digital Signature Certificates and the provision of eSign facilities; these are overseen by the Controller of Certifying Authorities (CCA), which operates under MeitY.
The second service involves issuing digital certificates to secure websites, software, and internet-based communications. These certificates are trusted by major web browsers and operating systems, and their issuance adheres to international regulations and security standards.
According to the government, the recent security incident pertains to this second service. This service undergoes audits by independent entities in accordance with international standards—including the 'WebTrust' audit conducted by BDO International Limited. MeitY is not involved in this audit process.
What is the issue?
When you access a bank or any other website, your browser verifies its digital certificate—essentially the website’s 'identity card.' Companies like eMudhra issue these certificates, which allow browsers to verify and trust the identity of a website.
According to reports, on April 30, 2025, eMudhra generated private keys associated with eight intermediate certificates. It is claimed that a technical glitch during this process left some keys extremely vulnerable—so weak, in fact, that they could easily be discovered using a computer.
What was the risk?
Had a hacker exploited these weak keys, they could have attempted to create fraudulent digital certificates in the name of legitimate websites. This posed the risk of creating fake websites that appeared authentic—convincing enough to be trusted even by web browsers. Such a scenario could have led to the theft of users' passwords and other sensitive personal information.
This vulnerability was discovered by an independent security researcher named 'Wayne,' who utilized AI technology to identify the weak keys and bring the issue to light. Subsequently, major tech companies—including Apple, Google, Microsoft, and Mozilla—were alerted to this potential threat.
What was the impact on Indian websites and applications?
The Ministry stated that the impact on Indian websites and applications was very limited and short-lived. The government is working closely with the relevant stakeholders to resolve the matter promptly. The Indian Computer Emergency Response Team (CERT-In) has also issued a safety advisory, outlining necessary steps to mitigate risks and enhance security.
The government has urged the public to disregard rumors circulating on social media. The Ministry indicated that further details regarding the incident will be shared once the investigation is complete. Crucially, the digital signature certificate and eSign services provided by eMudhra—which operate under the regulation of the Controller of Certifying Authorities (CCA)—remain entirely unaffected by this incident.
Disclaimer: This content has been sourced and edited from TV9. While we have made modifications for clarity and presentation, the original content belongs to its respective authors and website. We do not claim ownership of the content.
