Major security flaw triggers action from Google and Apple against eMudhra certificates
eMudhra’s digital certificates were found with weak security keys, risking data interception and manipulation. Major tech companies block affected certificates as eMudhra investigates and works to contain the issue.
- Oct 21, 2026,
- Updated Oct 21, 2026 4:23 PM IST
eMudhra, an Indian certificate authority (CA) that issues digital certificates, is reportedly under fire for dangerously weak security keys in eight of its certificates. This can potentially allow attackers to create a fake digital certificate for almost any website and intercept or manipulate data exchanged between users and those websites.
Google, Apple, Microsoft and Mozilla have now blocked the affected certificates to prevent their products from trusting certificates associated with the compromised keys. Reportedly, Cloudflare identified the issue at around 10:30 pm IST on October 19, but it found no evidence that the compromised certificates had been exploited on its own services.
Must read: AI out of control: US govt websites hit as OpenAI bots bypass security controls
eMudhra incident impact
eMudhra incident has raised two major concerns about how such a serious security weakness was allowed to happen, and how quickly the internet can be protected against it. But what does the company do, and why is it a critical issue?
eMudhra is an Indian digital trust and cybersecurity company that issues digital certificates and acts as a digital identity and authentication. These digital certificates act as a website's identity card. So, when you visit a website, your browser needs to check whether it is communicating with the genuine website or not. This certificate helps verify that identity and supports the establishment of an encrypted HTTPS connection.
Don't Miss: Another roadblock for Elon Musk's Starlink? Govt mulls security system for foreign satcom firms
Now, after the incident with the 8 eMudhra certificates, the company has issued a formal statement acknowledging the security concerns and outlining its response to the compromised certificates. “eMudhra is actively investigating a security incident involving a specific set of intermediate CA certificates created as part of a Key Generation Ceremony (KGC) conducted in April 2025 within its public trust infrastructure,” the company said.
“The incident is limited to these specific intermediate CA certificates and does not affect eMudhra's root CA private keys or other intermediate CAs,” it added.
Furthermore, the company said it had taken required steps to contain the affected certificates and was working with browser developers and other operators to prevent potential misuse. The investigation is ongoing, and further updates will be provided as more details emerge.
As far as users are concerned, they need to keep their browsers and apps up to date
For Unparalleled coverage of India's Businesses and Economy – Subscribe to Business Today Magazine
eMudhra, an Indian certificate authority (CA) that issues digital certificates, is reportedly under fire for dangerously weak security keys in eight of its certificates. This can potentially allow attackers to create a fake digital certificate for almost any website and intercept or manipulate data exchanged between users and those websites.
Google, Apple, Microsoft and Mozilla have now blocked the affected certificates to prevent their products from trusting certificates associated with the compromised keys. Reportedly, Cloudflare identified the issue at around 10:30 pm IST on October 19, but it found no evidence that the compromised certificates had been exploited on its own services.
Must read: AI out of control: US govt websites hit as OpenAI bots bypass security controls
eMudhra incident impact
eMudhra incident has raised two major concerns about how such a serious security weakness was allowed to happen, and how quickly the internet can be protected against it. But what does the company do, and why is it a critical issue?
eMudhra is an Indian digital trust and cybersecurity company that issues digital certificates and acts as a digital identity and authentication. These digital certificates act as a website's identity card. So, when you visit a website, your browser needs to check whether it is communicating with the genuine website or not. This certificate helps verify that identity and supports the establishment of an encrypted HTTPS connection.
Don't Miss: Another roadblock for Elon Musk's Starlink? Govt mulls security system for foreign satcom firms
Now, after the incident with the 8 eMudhra certificates, the company has issued a formal statement acknowledging the security concerns and outlining its response to the compromised certificates. “eMudhra is actively investigating a security incident involving a specific set of intermediate CA certificates created as part of a Key Generation Ceremony (KGC) conducted in April 2025 within its public trust infrastructure,” the company said.
“The incident is limited to these specific intermediate CA certificates and does not affect eMudhra's root CA private keys or other intermediate CAs,” it added.
Furthermore, the company said it had taken required steps to contain the affected certificates and was working with browser developers and other operators to prevent potential misuse. The investigation is ongoing, and further updates will be provided as more details emerge.
As far as users are concerned, they need to keep their browsers and apps up to date
For Unparalleled coverage of India's Businesses and Economy – Subscribe to Business Today Magazine