'Impact has been very limited': MeitY on eMudhra security incident, says Indian DSC and eSign unaffected

The Ministry of Electronics and Information Technology (MeitY) on Wednesday said it has taken “serious note” of the reported security incident involving eMudhra’s Public Key Infrastructure (PKI) and has formed a special team to investigate the matter.

The ministry also warned against what it called “fear mongering” on social media over the possible impact of the incident. It said the issue is limited to eMudhra’s global website-security business and does not affect its Digital Signature Certificate (DSC) and eSign services regulated by the Controller of Certifying Authorities (CCA).

“The impact of this incident on Indian websites and applications have been very limited and for a very short interval,” the ministry said.

What is the eMudhra security issue

The issue came to light after researchers identified weak cryptographic keys in eight intermediate digital certificates linked to eMudhra.

The vulnerability could potentially allow attackers to create fake website certificates, making malicious websites appear trusted by internet browsers.

On October 17, 2026, researchers identified a vulnerability affecting eight intermediate Certificate Authority (CA) certificates linked to eMudhra’s global website-security business.

The private keys behind these certificates had reportedly been generated with insufficient randomness, potentially making them easier to recover using publicly available certificate information.

Don't Miss: BT Explainer: Why Google, Apple and Mozilla took action against eMudhra certificates

Intermediate CA certificates are used to issue digital certificates to websites. If their private keys are compromised, attackers could potentially create fraudulent certificates and impersonate legitimate websites.

Which eMudhra services are affected

MeitY said eMudhra operates in two distinct areas.

The first is the issuance of Digital Signature Certificates and eSign services, regulated by the CCA under MeitY.

The second is the issuance of digital certificates trusted by major browsers and operating systems. These are used to secure websites, software and online communications.

MeitY said the reported incident relates only to the second function.

It said this business is international in nature and operates under a global trust framework. It is governed by international standards and subject to independent audits, including WebTrust audits conducted by BDO International Limited.

MeitY said it is not involved in its audit.

Why Google, Apple and Mozilla took action

Following the discovery, major technology companies moved to restrict trust in the affected certificates.

Google announced measures to block the compromised intermediate certificates in Chrome and planned to remove the associated emSign ECC Root CA – G3 certificate from its trust store.

Mozilla, Apple and Microsoft also took steps to block the affected certificates.

Legitimate websites using the affected certificate chain could face security warnings or connectivity problems until they move to replacement certificates.

Must Read: SBI data breach? Hacker claims leak of 3.75 lakh records, over 2,700 documents

Are Indian users affected

eMudhra has maintained that its Indian DSC and eSign services remain unaffected. It has described the vulnerability as limited to eight intermediate certificates used in its global website-security business.

The company has also stated that its infrastructure was not compromised and that no data breach occurred.

MeitY has reiterated that Digital Signature Certificates and eSign services regulated by the CCA remain completely unaffected.

What happens next

MeitY said it remains engaged with stakeholders to resolve the incident at the earliest. CERT-In has also issued an advisory, including mitigation measures.

“Further details will be shared upon completion of the investigation,” MeitY said.

As of October 21, 2026, public reports had not established widespread attacks exploiting the compromised keys. However, the absence of confirmed misuse does not eliminate the possibility of exploitation.

Users should keep their browsers and operating systems updated and avoid bypassing browser warnings about invalid security certificates.