MeitY Probes eMudhra Security Incident, Assures Domestic Services Remain Safe

New Delhi: The Ministry of Electronics and Information Technology (MeitY) has launched an official probe into a security vulnerability identified within the global Public Key Infrastructure (PKI) operations of the digital certification firm eMudhra. The government’s intervention follows reports of a flaw in the company’s key-generation process that initially sparked concerns regarding the integrity of digital trust frameworks.

In an official statement, MeitY sought to quell public anxiety, labeling recent social media commentary as “fear-mongering.” The ministry emphasized that the impact of the security lapse has been minimal and confined to a very short duration.

Distinction Between Domestic and Global Operations

A primary focus of the government’s response is the clear separation between eMudhra’s government-regulated domestic services and its independent international business. MeitY clarified that all Digital Signature Certificates (DSC) and eSign services issued under the oversight of the Controller of Certifying Authorities (CCA) remain completely secure and unaffected.

“The reported incident pertains exclusively to eMudhra’s international functions, which operate under a global trust framework governed by international standards and independent audits,” the ministry stated. Officials reiterated that while the government mandates the security of domestic infrastructure, it is not involved in the auditing of the firm’s global, browser-trusted operations.

Understanding the Vulnerability

The security incident centers on eight intermediate certificate authorities that experienced a technical failure during a key-generation ceremony held on April 30, 2025. Investigations revealed a process flaw that caused the creation of “weak” cryptographic keys alongside the intended robust ones.

These affected certificates were linked to global Transport Layer Security (TLS) and code-signing operations. Under normal circumstances, TLS certificates act as digital passports for websites, allowing browsers to verify identity and establish encrypted connections. Code-signing certificates serve a similar role for software, verifying that applications originate from legitimate publishers and have not been tampered with.

Security researchers warned that weak cryptographic keys could, in theory, allow malicious actors to impersonate legitimate websites or distribute fraudulent software by issuing unauthorized certificates.

Industry Response and Mitigation

The vulnerability came to light on October 17, 2026, when a security researcher reported the flaw to browser giants. In response, Google’s Chrome team and Mozilla’s Firefox moved quickly to block the affected intermediate authorities to prevent any potential exploitation.

eMudhra has confirmed that, according to its internal tracking, no TLS certificates chaining to the compromised intermediates were recorded in public Certificate Transparency logs prior to the remedial blocking actions. The company is currently utilizing certified security modules to conduct a comprehensive root cause analysis.

Government Coordination

The Indian Computer Emergency Response Team (CERT-In) has issued an advisory to stakeholders outlining necessary mitigation measures. MeitY continues to monitor the situation closely to ensure the integrity of the digital ecosystem.

“MeitY remains engaged with all stakeholders to resolve this incident at the earliest,” the government added, promising that further updates would be released once the official investigation concludes. For the general public and domestic users of eMudhra’s local services, the government has emphasized that there is no cause for concern, as their digital credentials remain fully intact.

Disclaimer: This content is auto-generated for informational purposes only.

Source: Read Original News