eMudhra security incident explained

eMudhra is a Bengaluru-based company that offers digital identity and cybersecurity services, including digital signature services, electronic authentication, and security certificates. The company's operations are divided into two main areas: providing regulated digital signature and eSign services in India, and offering global website-security certificates.

Digital certificates play a crucial role in establishing website trust and enabling secure connections. When you visit a website using HTTPS, your browser checks the website's digital certificate to verify its identity. These certificates are issued by trusted authorities known as Certificate Authorities (CAs), and browsers maintain lists of trusted CAs.

In the recent security incident, on October 17, 2026, security researchers alerted various technology companies, including Google, Mozilla, Apple, and Microsoft, about vulnerabilities related to eight intermediate certificates issued by eMudhra. Six of these certificates were intended for website security, while two were for software signing.

The issue was with the weak private keys associated with these certificates, making them susceptible to being recovered using publicly available information. However, there is no evidence that eMudhra's infrastructure was compromised or that customer certificates were issued using the affected keys. The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the incident, and India's regulated digital signature certificate and eSign services remain unaffected.