E-Signature Services Not Affected: Government On eMudhra Web Security Certificates Row

The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate a reported security incident involving eMudhra's Public Key Infrastructure (PKI), while stating that the impact on Indian websites and applications was limited and that the company's Digital Signature Certificate (DSC) and eSign services remain unaffected.

"MeitY has taken serious note of the reported incident. A special team has been constituted to investigate the matter," the government said in a statement. Addressing concerns circulating on social media, the government added that some accounts were "indulging in fear mongering about the impact of this incident".

"The impact of this incident on Indian websites and applications [has] been very limited and for a very short interval," it said.

The security incident sparked worries as, every time a browser shows a website is secure, it relies on digital certificates issued by a trusted company or authority, such as eMudhra. Each authority signs these certificates with a secret cryptographic key. eMudhra's disclosures say the keys for eight of its intermediate authorities were generated weakly, which, in theory, could let an attacker issue a fake certificate under eMudhra's name and pass off a fraudulent website or software as real.

The government has said this is separate from the digital signatures eMudhra issues under Indian regulation for signing documents electronically, and that those are unaffected.

The government stressed that eMudhra operates in two distinct areas: the issuance of Digital Signature Certificates and eSign services regulated by the Controller of Certifying Authorities (CCA) under MeitY; and the issuance of digital certificates trusted by major browsers and operating systems to secure websites, software and online communications.

"The second function is international in nature and operates under [a] global trust framework. It is governed by international standards and subject to independent audits," the statement said. "The reported security incident pertains to this only. MeitY is not involved in its audit," it added. "Important to note that Digital Signature Certificates and eSign services regulated by CCA remain completely unaffected by this incident," the statement further said.

In its incident disclosures, eMudhra said the issue involved eight intermediate certificate authorities associated with its global business. The company traced the problem to a key-generation ceremony conducted on April 30, 2025, when a process flaw resulted in weak cryptographic keys being generated alongside the intended strong keys.

The affected certificates were associated with the company's global Transport Layer Security (TLS) and code-signing operations. TLS certificates help browsers authenticate websites and establish encrypted connections, while code-signing certificates are used to verify software publishers and the integrity of signed software.

Weak certificate-authority keys can create a risk of fraudulent certificates being issued under an affected authority, potentially allowing attackers to impersonate legitimate websites or software publishers if the certificates remain trusted.

eMudhra said the key-generation process used certified security modules, and it is now investigating the root cause of the incident.

Google's Chrome browser security team said it received a report from a security researcher on October 17, 2026, concerning the affected eMudhra intermediate certificate authorities. Google subsequently blocked the affected intermediates.

The company said no TLS certificates chaining to six affected website-certificate intermediates had been recorded in Certificate Transparency logs before the blocking action. Certificate Transparency logs provide publicly auditable records of issued TLS certificates and help identify potentially suspicious certificate issuance.

Mozilla also announced measures to block the affected certificates in its Firefox browser after receiving the report on October 17.

The government said CERT-In had issued an advisory containing mitigation measures and that MeitY was coordinating with stakeholders to address the incident. "MeitY remains engaged with all the stakeholders to resolve this incident at the earliest," the statement said. "Further details will be shared upon completion of the investigation," it added.