The discovery of a major security issue in eMudhra has caused alarm, raising questions about the potential threat to internet users' data. The focus is on the issue of weak cryptographic private keys in eMudhra.
Google and Mozilla have decided to block the affected certificates. A natural question arises as to whether the data of Indian users is at risk, and what response the Ministry of Electronics and Information Technology (MeitY) should provide.
The company eMudhra has come under intense scrutiny following the discovery of a critical vulnerability in eight intermediate Certificate Authority keys associated with its global website security business. This vulnerability raises serious concerns regarding the systems browsers use to establish trust on the network.
This flaw potentially allowed attackers to create fraudulent HTTPS certificates and impersonate legitimate web resources. According to an eMudhra statement dated October 21, 2026, the keys were generated on April 30, 2025, but the weakness went undetected for about eighteen months.
A Certificate Authority (CA) is responsible for verifying authenticity and issuing digital certificates. Intermediate authorities operate under the umbrella of a root certificate trusted by browsers and operating systems.
eMudhra reported that during the key generation process, a key wrapping/unwrapping stage created a second, weak set of keys, which was subsequently published in browser root certificate stores. Although the company assured that its root private key was not compromised, browser operators took precautionary measures and revoked trust in the associated emSign ECC Root CA - G3 root CA.
Google's Chrome security team warned that this vulnerability allows anyone to forge trusted HTTPS certificates to mimic any site against clients who have not yet removed trust in these CAs. Google has blocked the affected keys and plans to remove the parent root from Chrome's trust store by October 27 Pacific Time. As a result, some legitimate websites using certificates under this root may stop working in Chrome.
Meanwhile, Mozilla blocked the affected certificates in Firefox within three hours of receiving the notification and released software updates to extend protection to users who might not receive automatic protection.
The immediate impact of the incident appears limited, although the investigation is ongoing. eMudhra emphasized that none of the eight affected intermediate authorities issued end-user certificates, its infrastructure was not compromised, and no data leaks occurred. The company identified one affected client ecosystem in the United States where certificate replacement is taking place.
The company also noted that its digital signature and eSign services in India, which operate on a separate infrastructure, remained unaffected. Acknowledging the uncertainty regarding the cause, eMudhra stated: 'We have not yet confirmed the exact root cause. We will publish it fully after completing our investigation.'
This incident highlights a broader issue for the digital trust industry. Encryption can protect communications, but only if the certificates verifying a website's identity are reliable. Therefore, browser manufacturers maintain their own lists of trusted certificates and can revoke acceptance when a provider's control fails.
Public certificate transparency logs also help detect suspicious certificate issuance. A complex question for eMudhra is how a weakness of this magnitude could go undetected during two audit cycles. The company stated that it is reviewing its key generation procedures and is offering corporate clients certificates from an additional Certificate Authority to reduce reliance on a single chain of trust.
