The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the leak of private keys associated with web security certificates issued by Bengaluru-based eMudhra.
In a post on X, the IT ministry said it had taken “serious note” of the incident and would look into the matter.
“Meity remains engaged with all the stakeholders to resolve this incident at the earliest. CERT-In has also issued an advisory in r/o the incident, including the mitigation measures,” the ministry said.
Founded in 2008, eMudhra has issued more than 60 million digital certificates to date.
A limited number of certificate authorities worldwide issue digital certificates under a global trust framework. Based on certificates issued by such authorities, web browsers determine whether a website can be trusted and establish secure connections.
Also Read
Earlier in the day, the Indian Computer Emergency Response Team (CERT-In) issued an advisory cautioning that private keys used for eMudhra’s digital certificates had been “generated with insufficient cryptographic randomness”, leading to their compromise.
“An attacker who recovers these private keys could issue fraudulent certificates for domains they do not control. Such TLS certificates could be used to impersonate legitimate websites and facilitate man-in-the-middle attacks, potentially enabling the interception or modification of encrypted communications where an attacker can intercept the network traffic and the affected certificate chains remain trusted by the client,” CERT-In said in its advisory.
The issue came to light after web browser company Mozilla published a report stating that private keys associated with eight eMudhra intermediate certificates had been compromised.
“Upon becoming aware of the incident, eMudhra initiated its incident response procedures, took measures to contain the affected certificates, and began working closely with browser and root-store operators to safeguard users and maintain the integrity of the broader WebPKI ecosystem,” eMudhra said in a statement.
The company said it was “conducting a thorough investigation” into the leak and the circumstances that led to the private keys being compromised.
“We are conducting a thorough investigation into the circumstances surrounding the incident and reviewing our security controls and operational procedures to identify and implement any necessary improvements,” eMudhra said.