What is eMudhra certificates? What to know about the security scare and could your data be at risk?

How do you know that websites you visit are safe or authentic? Well, the padlock in your browser’s address bar assures that the website you have reached is the one it claims to be. However, on October 21, the assurance was weakened as a small set of certificates from eMudhra’s Indian digital signature services were found to be compromised.

The immediate action? Browsers like Google Chrome, Mozilla, and Apple blocked the affected certificates within hours, and luckily there were no reports of any user’s data or account being compromised. While everyday users were required to update their browser apps, website operators and IT teams had more work. Here’s what went wrong, and what you need to know about the eMudhra services.

Must read: 'Gross negligence, unforgivable': eMudhra faces fury over security lapse, techies question leadership

What is eMudhra, and what does it do?

eMudhra is a Bengaluru-based company, a licensed Certifying Authority (CA) in India under the IT Act, and it has the authority to issue digital certificates. The company runs two distinct businesses: one is digital signature certificates (DSCs) and eSign services, and the other is the website (TLS/SSL) and code-signing certificates sold under the emSign brand. As per the company, it has issued over 60 million digital certificates.

Why are its digital certificates important for your online activity?

A digital certificate works as an identity card for websites. Therefore, your browser only trusts a site’s certificate issued by a CA that the browser, phone, or operating system already trusts. When that check passes, you see the padlock and your connection to the site is encrypted.

Each of these certificates holds a private key: a secret number that only the owner has access. Whoever holds the key can sign certificates that browsers will accept. Now, a compromised private key means the secret is no longer secret, and anyone can act as that CA. This is why the eMudhra certificate vulnerability was considered a major incident.

Must read: eMudhra certificate alert: How to update Windows, macOS and Linux devices for better security

After the incident broke, Mozilla warned that such keys could let attackers issue fraudulent HTTPS certificates for websites, directly impacting users' businesses.

What happened in the security scare?

On April 30, 2025, eMudhra created a batch of intermediate certificates during a key generation ceremony, in which eight of them were affected. On October 17, A researcher known as Wayne reported that the private keys of eight eMudhra intermediate certificates were compromised. Chrome and Mozilla. Both the browsers and Apple blocked the certificates, and eMudhra says it has revoked all eight on this date.

Google said that the eight eMudhra digital certificates were compromised because the private keys were generated using insufficient randomness, making them extremely easy to guess or recover.

In a statement, eMudhra says said that the system created two set of keys alongside the strong ones, and the weak set, and both got published to browser trust lists. The keys were made on certified hardware security modules, it says. The flaw went unnoticed for about 18 months, through two independent audits, and the root cause is still under investigation.

Must read: eMudhra certificate alert: How to update Android and iPhone apps to improve your device security

Could your personal data or online accounts be at risk?

As of now, theft of user data has been reported after the incident. eMudhra says its infrastructure was not compromised and no data was breached. It says only one of the eight was ever used in production, and that none of them issued a certificate to any website. However, CERT-In says the public disclosures do not establish confirmed malicious use of the keys as of October 21, according to The Hacker News.

What should you do now to stay safe?

• It is advised that users keep their browser and device updated. Chrome and Firefox received the block in the background without an update. Firefox on Android got a follow-up fix (158.0.2), and Firefox 158.0.1 covers installations where the background block list is disabled by policy or blocked on the network. Google says Android devices received the block via Google Play Services and a restart picks it up immediately.
• Do not click through certificate warnings. A warning could mean a legitimate site is mid-migration to a new certificate after the root’s removal, or something more serious. 
• Be careful of unsolicited links asking you to log in. 
• As of now, one of the browser or company advisories asked everyday users to change passwords.