NEW DELHI, October 22 (Aalimi Nation) – The Ministry of Electronics and Information Technology has formed a special team to investigate the eMudhra certificate flaw, saying its effect on Indian websites and apps was "very limited and for a very short duration". The ministry said Digital Signature Certificates and eSign services regulated by the Controller of Certifying Authorities were "completely unaffected".
What went wrong in the eMudhra certificate flaw
Google, Mozilla, Apple and Microsoft have blocked eight intermediate certificates issued under the international operations of eMudhra, a Bengaluru-based certifying authority. The secret keys behind them were found to be critically weak. Six of the certificates were meant to secure websites, and two were for signing software.
Mozilla and Google's Chrome team said the keys were not stolen. They were generated with too little randomness and could be worked out from the public certificates almost instantly. Anyone holding such keys could, in principle, issue certificates that browsers would accept as genuine. An independent researcher flagged the problem on October 17, and Chrome and Firefox added blocks within hours. Apple and Microsoft followed on October 19 and 20.
The company's explanation
In a statement, eMudhra said a flaw in a key-generation ceremony held on April 30, 2025 produced a second, weaker set of keys alongside the intended ones, and that human errors occurred at several steps. The company said its systems were not breached and no data was lost. It said only one of the eight intermediates had been used in production, and none had issued certificates to end customers.
eMudhra also said its Indian digital signature and eSign businesses run on separate infrastructure. It described the affected website-certificate business as about 1 per cent of its revenue, while acknowledging reputational risk it cannot quantify. Its shares fell by the 20 per cent lower circuit limit on the National Stock Exchange on Wednesday.
Government advisory
The Indian Computer Emergency Response Team (CERT-In), the national cybersecurity agency, said the keys lacked sufficient randomness and could be recovered almost immediately. It warned of fake website certificates, interception of encrypted traffic, stolen passwords and financial fraud. It added that the two software-signing keys could make malicious code appear to come from a trusted publisher.
CERT-In said public disclosures did not establish confirmed malicious use as of October 21. It asked government departments, companies, internet service providers and website administrators to update browsers and operating systems, refresh their lists of trusted certificates, replace certificates linked to the affected chain, and avoid bypassing certificate warnings.
Mozilla removed eMudhra's root certificate, known as emSign ECC Root CA – G3, from its trusted list on October 20. Chrome is due to remove it on October 27. CERT-In cautioned that the removal could disrupt legitimate services, and eMudhra has said about 30,000 website certificates must be reissued from a different, unaffected root. Servers that keep their own trusted-certificate lists, including some Linux and Windows systems, need separate updates.
Several questions remain open. Whether anyone exploited the keys before the blocks took effect is not known. Google has yet to decide whether eMudhra's remaining root will stay trusted in Chrome, a decision that will shape the future of the company's global website-certificate business. Mozilla said it is working with eMudhra and others to establish the root cause, and the company has said it will re-examine all its key ceremonies.
