The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate a security incident involving eMudhra’s global digital certificate infrastructure, stating that the impact on Indian websites and applications was limited and short-lived.
In a series of posts on X, the ministry said it had taken serious note of the incident and was working with stakeholders to address the issue.
MeitY clarified that eMudhra’s Digital Signature Certificate (DSC) and eSign services, regulated by the Controller of Certifying Authorities (CCA) under the ministry, remained unaffected.
The ministry said eMudhra operates in two distinct areas. The first involves the issuance of digital signature certificates and the provision of eSign services regulated by the CCA. The second covers digital certificates trusted by major web browsers and operating systems to secure websites, software and online communications.
According to MeitY, the reported incident concerns only the latter category, which operates internationally under a global trust framework. The ministry said this part of eMudhra’s operations is subject to independent audits, including WebTrust audits conducted by BDO International Limited, and clarified that MeitY was not involved in auditing these operations.
The incident came to light on October 17 after a security researcher alerted Google and other technology companies to vulnerabilities involving private keys associated with eight intermediate digital certificates issued under eMudhra’s global Public Key Infrastructure (PKI).
Following the alert, Google and Mozilla moved to block the affected certificates.
eMudhra subsequently said that all eight certificates had been revoked on October 19 and that none of them had issued customer certificates. The company also stated that its infrastructure had not been compromised and that no data breach had occurred.
Meanwhile, the Indian Computer Emergency Response Team (CERT-In) has issued an advisory on the incident, outlining mitigation measures.
MeitY said further details would be shared after the investigation is completed. The ministry added that it would continue to coordinate with stakeholders to address the matter.
-Ani
