BT Explainer: Why Google, Apple and Mozilla took action against eMudhra certificates
eMudhra is an Indian digital trust and cybersecurity company that provides digital signatures, electronic authentication and website security services
- Oct 21, 2026,
- Updated Oct 21, 2026 4:33 PM IST
The eMudhra cybersecurity issue has raised concerns about internet security after researchers identified weak cryptographic keys in eight intermediate digital certificates associated with the Indian cybersecurity company. The vulnerability could potentially allow attackers to create fraudulent website certificates, making malicious websites appear trustworthy to internet browsers.
The development has drawn attention to the role of digital certificates in securing online communications and verifying website identities. However, eMudhra has maintained that its Indian Digital Signature Certificate (DSC) and eSign services remain unaffected.
READ THIS: SBI data breach? Hacker claims leak of 3.75 lakh records, over 2,700 documents
What is eMudhra and what went wrong?
eMudhra is an Indian digital trust and cybersecurity company that provides digital signatures, electronic authentication and website security services. Its certificate infrastructure helps establish secure connections between websites and browsers.
On October 17, 2026, researchers identified a vulnerability affecting eight intermediate Certificate Authority (CA) certificates associated with eMudhra's global website-security business. The private cryptographic keys behind these certificates had reportedly been generated with insufficient randomness, potentially making them easier to recover using publicly available certificate information.
Intermediate CA certificates play a crucial role in issuing digital certificates to websites. If their private keys are compromised, attackers could potentially create fraudulent certificates and impersonate legitimate websites, putting users and online communications at risk.
Why did Google, Apple and Mozilla take action?
Following the discovery, major technology companies moved to restrict trust in the affected certificates. Google announced measures to block the compromised intermediate certificates in Chrome and planned to remove the associated emSign ECC Root CA – G3 certificate from its trust store.
Mozilla, Apple and Microsoft also took steps to block the affected certificates. These measures are intended to prevent browsers from accepting potentially fraudulent certificates. However, legitimate websites relying on the affected certificate chain could experience security warnings or connectivity problems until they migrate to replacement certificates.
Are Indian users and digital signatures affected?
The development has raised questions about whether people using eMudhra's digital signatures for tax filings, business transactions and official documents need to take action.
The company has said its Indian DSC and eSign services are unaffected, describing the vulnerability as limited to eight intermediate certificates used in its global website-security business. It has also stated that its infrastructure was not compromised and that no data breach occurred.
ALSO READ: IMF warns AI market correction could hit India, flags risks to IT and back-office sector
As of October 21, 2026, public reports had not established widespread attacks exploiting the compromised keys. However, the absence of confirmed misuse does not eliminate the possibility of exploitation.
What should users do?
Users should keep their browsers and operating systems updated, avoid suspicious links and never bypass browser warnings about invalid security certificates. Website operators using the affected certificate chain should follow their certificate provider's guidance and migrate to unaffected certificates where necessary.
The eMudhra cybersecurity issue has raised concerns about internet security after researchers identified weak cryptographic keys in eight intermediate digital certificates associated with the Indian cybersecurity company. The vulnerability could potentially allow attackers to create fraudulent website certificates, making malicious websites appear trustworthy to internet browsers.
The development has drawn attention to the role of digital certificates in securing online communications and verifying website identities. However, eMudhra has maintained that its Indian Digital Signature Certificate (DSC) and eSign services remain unaffected.
READ THIS: SBI data breach? Hacker claims leak of 3.75 lakh records, over 2,700 documents
What is eMudhra and what went wrong?
eMudhra is an Indian digital trust and cybersecurity company that provides digital signatures, electronic authentication and website security services. Its certificate infrastructure helps establish secure connections between websites and browsers.
On October 17, 2026, researchers identified a vulnerability affecting eight intermediate Certificate Authority (CA) certificates associated with eMudhra's global website-security business. The private cryptographic keys behind these certificates had reportedly been generated with insufficient randomness, potentially making them easier to recover using publicly available certificate information.
Intermediate CA certificates play a crucial role in issuing digital certificates to websites. If their private keys are compromised, attackers could potentially create fraudulent certificates and impersonate legitimate websites, putting users and online communications at risk.
Why did Google, Apple and Mozilla take action?
Following the discovery, major technology companies moved to restrict trust in the affected certificates. Google announced measures to block the compromised intermediate certificates in Chrome and planned to remove the associated emSign ECC Root CA – G3 certificate from its trust store.
Mozilla, Apple and Microsoft also took steps to block the affected certificates. These measures are intended to prevent browsers from accepting potentially fraudulent certificates. However, legitimate websites relying on the affected certificate chain could experience security warnings or connectivity problems until they migrate to replacement certificates.
Are Indian users and digital signatures affected?
The development has raised questions about whether people using eMudhra's digital signatures for tax filings, business transactions and official documents need to take action.
The company has said its Indian DSC and eSign services are unaffected, describing the vulnerability as limited to eight intermediate certificates used in its global website-security business. It has also stated that its infrastructure was not compromised and that no data breach occurred.
ALSO READ: IMF warns AI market correction could hit India, flags risks to IT and back-office sector
As of October 21, 2026, public reports had not established widespread attacks exploiting the compromised keys. However, the absence of confirmed misuse does not eliminate the possibility of exploitation.
What should users do?
Users should keep their browsers and operating systems updated, avoid suspicious links and never bypass browser warnings about invalid security certificates. Website operators using the affected certificate chain should follow their certificate provider's guidance and migrate to unaffected certificates where necessary.