What is eMudhra?
The company behind digital trust
eMudhra is an Indian digital trust company that issues digital signatures and digital certificates. These certificates help browsers verify that websites are who they claim to be, so connections are secure.
What went wrong?
Eight keys. One serious security flaw.
8 intermediate certificate authorities linked to eMudhra were found to have dangerously weak private keys. Because they were so weak, security researchers cracked them almost instantly.
How it could affect normal users
Could a fake website fool your browser?
While weak keys could allow fake websites to appear trustworthy, the risk to you may be minimal, as your browser blocks these keys within hours. Additionally, no website certificates linked to these keys have been found in public Certificate Transparency logs. Although there is no confirmed evidence of successful attacks using these keys, some legitimate websites or apps may experience connection issues.
eMudhra’s claims
The company says its Indian services are safe
According to eMudhra, their infrastructure wasn’t hacked, no data breach took place, and none of the affected certificates were used for issuing certificates for any end-user websites. It further claims that its Indian digital signature and eSign services remain unaffected by this incident. The investigation is still going on.
Google, Mozilla, Microsoft and Apple’s response
Tech giants move to block the keys
Google and Mozilla blocked the affected certificates, while Apple and Microsoft also took protective action. Google has additionally announced plans to remove the associated root certificate from Chrome’s trust store, with the change expected on October 27, 2026. Don't worry if you see an alert, some safe services just need their certificates renewed
Government response
MeitY launches a probe
The Ministry of Electronics and IT has formed a special team to investigate the incident. CERT-In has issued a cybersecurity warning. The government said that the impact on Indian websites and apps was small and lasted only a short time. Thankfully, India's digital signature (DSC) and eSign services were not affected at all.
What users should do?
See a security warning? Don’t click through.
Keep your phone and browser updated to stay safe. If you see a 'Your connection is not private' warning on a website, stay cautious. Don’t enter any passwords or payment details. Wait until the website fixes the security problem before using it again.