- News Updates
- PSU Watch
- Defence News
- Policy Watch
- हिन्दी न्यूज़
- Jobs Watch
- States News
- Event News
New Delhi: Indian digital certification company eMudhra has reported a security vulnerability involving private keys linked to eight digital certificates, prompting a warning from the Indian Computer Emergency Response Team (CERT-In) over potential website impersonation, fraudulent certificates and cyberattacks.
Follow The PSUWatch Channel on Whatsapp
The incident has raised concerns over the security of digital trust infrastructure used to authenticate websites, protect online communications and verify software. However, eMudhra has maintained that its Indian Digital Signature Certificate (DSC) and eSign businesses remain unaffected.
Government sources said the problem was confined to the company's international certificate operations and its impact on India was expected to be limited.
"We are taking it up with them, and we are also taking it up with other operators to check whether they have further issues," a source said.
According to CERT-In, the security issue involves private keys associated with eight intermediate Certificate Authority (CA) certificates in eMudhra's Public Key Infrastructure (PKI). These include six Transport Layer Security (TLS) certificates and two code-signing certificates.
PKI forms the backbone of digital authentication, using cryptographic keys and certificates to establish trust between websites, applications and users.
TLS certificates, commonly associated with HTTPS websites, help establish encrypted connections between browsers and online services.
The compromise of certificate-signing keys can potentially allow attackers to create fraudulent certificates, impersonate legitimate websites or intercept sensitive communications.
"An attacker possessing these private keys could issue fraudulent certificates for domains they do not control. Such TLS certificates could be used to impersonate legitimate websites and facilitate man-in-the-middle (MitM) attacks, potentially enabling the interception or modification of encrypted communications.
"The compromised code-signing keys could also be used to issue fraudulent code-signing certificates," Cert-IN said.
Such vulnerabilities could potentially be exploited to create fake banking or payment websites designed to deceive customers and steal sensitive information.
Seeking to contain concerns, eMudhra said the incident did not involve unauthorised access to its infrastructure or any breach of customer data.
The company attributed the problem to a technical flaw that resulted in the generation of weak cryptographic keys alongside the original stronger keys.
A security researcher reportedly alerted Apple, Google, Microsoft and Mozilla that the weaker keys could potentially be reverse-engineered, including through AI-assisted techniques.
eMudhra said its physical and logical security controls remained intact.
"The affected global TLS business is a very small part of eMudhra’s operations and accounts for around 1 per cent of the company’s revenue. However, this may have some reputational risks for eMudhra, which cannot be quantified.
"eMudhra is working directly with customers who may be affected to give them replacement certificates, so that critical services are not disrupted. The company is also working with the root programs and continues its root-cause investigation," eMudhra said.
Although the affected business contributes only a small share of revenue, the incident could raise questions about confidence in the company's certificate issuance and security processes.
Major browser developers have initiated protective measures following the disclosure.
Google has blocked the public keys of the affected TLS intermediate certificates in Chrome through an update to its Certificate Revocation List Set (CRLSet).
The technology company has also announced the removal of eMudhra's emSign ECC Root CA-G3 from the Chrome Root Store, with the change scheduled to reach devices relying on the store from October 27, 2026.
Mozilla has separately blocked the six affected TLS intermediate certificates.
eMudhra's emSign platform provides digital trust services globally, including SSL/TLS certificates, email security, code signing and certificate lifecycle management.
The browser companies' intervention is significant because digital certificates underpin the trust mechanisms used to establish secure online connections.
The eMudhra disclosure comes amid heightened concerns over cybersecurity following State Bank of India's (SBI) announcement of suspected exposure of customer information on the dark web.
India's largest lender recently disclosed that a preliminary examination of approximately 3.75 lakh records identified 3,897 customer records containing personally identifiable information.
The information potentially exposed included names, mobile numbers, dates of birth, gender, email addresses and residential addresses.
Other records reportedly contained branch identifiers, Customer Information File (CIF) numbers, lead IDs and metadata associated with loan-related files.
SBI said it received the initial alert from its threat intelligence service provider on October 16 and subsequently activated its cyber incident response and containment protocols.
The bank has engaged an independent CERT-In-empanelled cybersecurity agency to investigate the suspected exposure.
However, SBI said further investigation was necessary to verify the authenticity of the records, establish their source and determine the extent of any compromise.
There is no established connection between the SBI incident and the vulnerability reported by eMudhra.
The two disclosures follow another critical cybersecurity advisory issued by CERT-In warning that autonomous artificial intelligence agents had accessed live systems and confidential information belonging to Indian organisations without authorisation.
In advisory CIAD-2026-0049, titled AI Agents as Attack Vectors, the agency identified incidents in which AI systems operating in research and evaluation environments exceeded their authorised tasks.
According to CERT-In, some autonomous agents accessed operational systems and retrieved business records containing personal information and confidential data.
The agency attributed these incidents partly to exposed credentials, insecure application configurations, publicly accessible code repositories and excessively permissive cloud access roles.
AI model providers themselves had disclosed some of these incidents, according to the advisory.
Taken together, the developments highlight different vulnerabilities confronting India's expanding digital economy — from certificate management and potential data exposure to risks associated with increasingly autonomous AI systems.
While eMudhra has maintained that its domestic services and customer data remain secure, the certificate-key incident underscores how weaknesses in digital authentication systems can have implications beyond the directly affected business.
Follow PSU Watch on LinkedIN
For regulators and technology companies, the challenge now extends beyond responding to individual incidents to strengthening preventive security controls, cryptographic safeguards and accountability across the digital ecosystem.
The immediate priority for eMudhra will be to complete its investigation, replace affected certificates and restore confidence among customers and global browser trust programmes.
(PSU Watch is India's Business News centre that places the spotlight on PSUs, Bureaucracy, Defence and Public Policy. 👉 Click to join our channel now: PSUWatch WhatsApp Channel. Prefer LinkedIn? Follow PSU Watch on LinkedIN. Click to stay connected on Twitter here and stay updated.)
