MeitY Investigates eMudhra Security Incident, Confirms Limited Impact on Indian Websites

The Ministry of Electronics and Information Technology (MeitY) has stated that a security incident involving eMudhra's global digital certificate infrastructure had a limited and short-lived impact on Indian websites and applications. The ministry has constituted a special team to investigate the matter.

In a series of posts on X, MeitY noted that it has taken serious note of the reported incident and is working alongside stakeholders to resolve it. The ministry clarified that eMudhra's Digital Signature Certificate (DSC) and eSign services, which are regulated by the Controller of Certifying Authorities (CCA) under MeitY, remain completely unaffected.

According to the ministry, eMudhra operates across two distinct areas. The first area involves the issuance of digital signature certificates and eSign services regulated by the CCA. The second area covers digital certificates trusted by major browsers and operating systems to secure websites, software, and online communications.

MeitY clarified that the reported incident relates solely to the second function. This segment operates internationally under a global trust framework and is subject to independent audits, such as WebTrust audits conducted by BDO International Limited. The ministry added that it is not involved in auditing this part of eMudhra's operations.

The clarification follows an incident involving eight intermediate digital certificates issued under eMudhra's global Public Key Infrastructure (PKI), which is used to establish trust in digital certificates and secure online connections. The issue surfaced on October 17 after a researcher alerted Google and technology companies that private keys associated with the certificates were vulnerable.

In response, Google and Mozilla moved to block the affected certificates. eMudhra reported that all eight affected intermediate certificates were revoked on October 19 and confirmed that none of them had issued customer certificates. The company also stated that its infrastructure was not compromised and that no data breach had occurred.

MeitY stated that the Indian Computer Emergency Response Team (CERT-In) has issued an advisory on the incident, including mitigation measures. The ministry will share further details once the investigation is complete, while continuing its engagement with stakeholders to resolve the issue.

"This incident highlights the critical importance of robust global trust frameworks and continuous infrastructure monitoring in the digital certificate ecosystem. While the impact on Indian websites was limited and domestic regulatory services remained unaffected, it serves as an important reminder for technology and cybersecurity stakeholders to maintain strict vigilance over intermediate certificates and key management practices." — Dr. Shishir Gupta, Founder & CEO, StartupLanes