Last Updated:
The private keys of 8 important intermediate certificates of e-Mudhra have been breached. eMudhra is a licensed certifying authority considered the backbone of digital identity and internet security in India.
To deal with cyber threats, government agency CERT-In has issued necessary instructions for both internet users and system administrators.
New Delhi. The private cryptographic keys of eight important intermediate certificates of e-Mudhra, the country’s main certification authority, have been breached. Indian Computer Emergency Response Team (CERT-In), the cyber security agency of the Government of India, has issued an advisory in this regard on 21 October 2026. The main root of this technical lapse was weak coding i.e. weak cryptographic randomness, due to which highly confidential digital keys leaked and became unsafe.
The leaked keys included six TLS certificates and two code-signing certificates. If understood in common language, these digital keys are legal proof of the authenticity of any website or software on the Internet. If these fell into the wrong hands, cyber attackers could create identical fake digital certificates in the name of any bank, government portal or company. With this, sensitive login details and financial data of internet users could be stolen by creating fake websites that look real.
What does eMudhra do and why is its role important?
eMudhra is a licensed certifying authority considered the backbone of digital identity and internet security in India. When signing income tax returns, government e-tenders or corporate documents, only eMudhra’s Digital Signature Certificate (DSC) and eSign are used. In addition, it also plays a crucial role in issuing SSL/TLS certificates that protect data sent between websites and Internet servers.
No direct attack on end-user
Amidst such a huge threat, the fortunate thing was that this security lapse was caught in time. According to CERT-In, eMudhra has clarified that no end-user certificates were issued to general customers or users from the affected intermediate certificates. Google has also confirmed that before blocking these six TLS certificates, no misuse or suspicious records had come to light.
Big action by Google and Mozilla
Seeing the seriousness of the matter, global tech companies have immediately taken strict action. Mozilla has released new security updates for the Firefox browser, blocking the affected TLS certificates. At the same time, Google has implemented strict security filters in the Chrome browser and has started the process of removing eMudhra’s ’emSign ECC Root CA – G3′ root certificate from its root store.
What should common users and companies do?
To deal with cyber threats, government agency CERT-In has issued necessary instructions for both internet users and system administrators-
- Update Firefox, Chrome, operating system and all essential software to the latest version immediately.
- Double-check the validity and status of digital certificates used in your systems and websites.
- Immediately remove the affected certificates and install new certificates from a completely secure and trusted authority.
- Do not ignore any ‘Security Warning’ or ‘Not Secure’ warning that appears on the screen while browsing the Internet.
- Keep a close eye on any suspicious changes or unauthorized activity in website files and software code.
About the Author
Ruli Bishnoi is a senior journalist with more than 20 years of experience in the media industry. He is currently associated with News18 Hindi (hindi.news18.com) and works in the business vertical. Here he discusses the difficult facts of the business world…
