CERT-In Investigates eMudhra Following Security Flaw in Trust Certificates

Digital trust services provider eMudhra is facing regulatory scrutiny from the Indian Computer Emergency Response Team (CERT-In) following a security incident involving compromised trust certificates. The issue stems from a process gap in key generation that affected eight trust certificates issued to websites and software.

The vulnerability was initially identified by a cyber researcher who publicized weaknesses in eMudhra's private keys, noting that threat actors could potentially exploit them to generate certificates and carry out man-in-the-middle attacks or impersonate legitimate websites. According to eMudhra, a flaw during key generation in April generated less-random numbers as keys, making them vulnerable to security breaches.

Global browsers including Google, Mozilla, Apple, and Microsoft have taken steps to block the affected certificates and remove them from trusted lists. CERT-In issued an advisory urging users to update browsers, operating systems, and replace affected certificates. The regulatory body also warned that older devices and outdated systems face higher risks, while legitimate websites could experience disruptions due to the removal of root certificates by browsers.

A Ministry of Electronics and Information Technology (MeitY) official stated that the government has taken serious note of the incident and constituted a special team to investigate. The official added that the impact on Indian websites and applications has been limited and brief, and clarified that the lapse occurred in a segment governed by global standards and subject to independent WebTrust audits rather than MeitY oversight.

Following the disclosure, eMudhra's stock fell over 20 percent to hit the lower circuit. The company stated that the issue affects only its global TLS business, which accounts for one percent of its revenue. eMudhra reported it is working with potentially affected customers to provide replacement certificates, though it did not disclose the specific number of impacted entities or a timeline.

Industry experts have pointed out broader concerns regarding oversight mechanisms. Yash Kadakia, CTO of Security Brigade, noted that the impact depends on how many systems globally trusted the compromised keys. Dipesh Kaura, Country Director for India and SAARC at Securonix, indicated that the incident could lead to a loss of trust in eMudhra's global certificate business.

Praveen Babu C, Chief AI Officer at SPR Consultech, questioned the effectiveness of independent security validation when weak keys pass through certificate issuance processes. Rajesh Chhabra, General Manager for India and South Asia at Acronis, added that the event highlights the need for continuous, independent verification of digital trust infrastructure rather than periodic audits alone. eMudhra maintains that its licensed Certifying Authority business for issuing Digital Signature Certificates under the Indian IT Act remains unaffected by the incident.

"This incident highlights the critical importance of robust internal controls and continuous compliance within digital infrastructure businesses. For technology companies operating in trust-based sectors, a single security lapse can rapidly impact market valuation and stakeholder confidence. Regulatory scrutiny and swift remediation are necessary steps, but rebuilding long-term institutional trust requires transparent communication and rigorous adherence to global security standards." — Dr. Shishir Gupta, Founder & CEO, StartupLanes