eMudhra Weak Link Tests India’s Chain Of Digital Trust
A private key meant to vouch for the security of websites around the world turned out to be the number…
On October 17, researcher Wayne discovered weaknesses in eight intermediate certificate authority (CA) certificates issued by Bengaluru-based eMudhra. These certificates, used by websites to verify their authenticity, contained private keys that could be easily reconstructed due to insufficient randomness during their generation.
In response, tech giants including Google, Mozilla, Apple, and Microsoft blocked the affected certificates, prompting a broader effort to protect browsers, applications, and enterprise systems. eMudhra shares plummeted to their 20% lower circuit at ₹431.55 on the BSE. The incident highlights the interconnectedness of the internet's security, showing how a single weak link can compromise trust across the entire system. eMudhra, a licensed certifying authority under India’s IT Act since 2008, offers digital identity and security solutions to businesses, financial institutions, and governments.
The company has taken steps to investigate the incident and revoke the affected intermediates, while emphasizing that its Indian Digital Signature Certificate (DSC) and eSign businesses remain unaffected. The event raises concerns about the oversight of India's role in global digital security infrastructure and the potential for fraud or misinformation if trust in certificate authorities is undermined.
Written by urgent.news from Inc42's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.