CERT-In Advisory, MeitY Probe And Global Revocations: The eMudhra Security Story Explained

The Ministry of Electronics and Information Technology (MeitY) has constituted a specialised investigation team following disclosures regarding a security incident in eMudhra’s Public Key Infrastructure (PKI). The development follows public revelations that eight intermediate Certificate Authority (CA) certificates issued under eMudhra’s global web-security banner were compromised due to cryptographic weaknesses in their private keys.

While central authorities have assured that the operational impact on Indian applications and government portals remains minimal and short-lived, the incident has drawn global attention across cybersecurity and web infrastructure domains.

Flawed Keys and Global Tech Restrictions

The vulnerability, initially flagged by independent security researchers, exposed

eight intermediate certificates containing private keys that lacked proper cryptographic randomness during generation. Flawed key-generation algorithms made the private keys mathematically easy to derive. In digital trust architectures, intermediate certificates authorise servers to establish encrypted connections; compromising their private keys allows malicious actors to issue unauthorised, spoofed SSL/TLS certificates for any website domain.

In response to the vulnerability, tech conglomerates including Google, Apple, Microsoft, and Mozilla instituted immediate revocation measures across their respective browsers and operating systems to prevent potential impersonation attacks or traffic interception. Global network providers like Cloudflare also deployed automated mitigations to protect underlying traffic networks.

MeitY Clarifies Scope: Domestic Services Remain Protected

Addressing public concern, MeitY confirmed that its special investigative task force is examining the origin and extent of the key generation flaw. However, officials emphasised a clear distinction between eMudhra’s international web-security business and its domestic operations.

The ministry clarified that core domestic services—including Digital Signature Certificates (DSC) and eSign frameworks regulated directly by the Controller of Certifying Authorities (CCA)—remain uncompromised. The international Public Key Infrastructure operates under separate global trust programs and WebTrust compliance protocols, keeping domestic digital identity infrastructure secure.

Mitigation Protocols and Continuous Oversight

The Indian Computer Emergency Response Team (CERT-In) has released an official technical advisory detailing precautionary measures for enterprise systems and network administrators. eMudhra confirmed that its physical databases and core logical servers suffered no unauthorised intrusion or data exfiltration. The company is distributing updated, valid replacement certificates directly to affected global clients.

MeitY maintains active oversight alongside CERT-In and domestic stakeholders as the official technical probe progresses. Further findings regarding the key-generation flaws are expected to be published upon completion of the special committee’s assessment.