MeitY Forms Special Team to Investigate eMudhra Digital Certificate Leak

The MeitY (Ministry of Electronics and Information Technology) has constituted a dedicated task force to probe into the breach which involving the private cryptographic keys of digital certificates belonging to eMudhra, a company based in the Bengaluru. According to an alert from the CERT-In (Indian Computer Emergency Response Team) on 22 October 2026, the compromised private keys were created using inadequate cryptographic entropy. This breach may enable cybercriminals to create fake Transport Layer Security (TLS) certificates and pose as genuine websites.

What Transpired in the Leakage of eMudhra Digital Certificates?

This incident was discovered when Mozilla found out that the private keys related to the eight eMudhra intermediate CA certificates had been leaked. These certificates form part of the Web Public Key Infrastructure (WebPKI), which is used by both browsers and operating systems to validate the authenticity of digital certificates.

Based on CERT-In’s Advisory issued on 21 October 2026, these private keys were created with poor cryptographic entropy and as a result, could be cracked from the public keys.

The company revealed that the certificates affected were created using a key generation procedure undertaken in April 2025. As per its findings, the company claimed that seven of the eight affected intermediates were never deployed in production and not a single one of them issued any end-entity certificate.

What is a Digital Certificate and Why Is It Important?

Digital certificates refer to electronically issued documents that associate identities like website domains with their public keys to help validate the websites and establish secure connections.

HTTPS digital certificates follow a chain of trust structure,

1. Root Certificate Authority

Trust anchor recognised by the browser or OS

2. Intermediate Certificate Authority

Issues or signs certificates on behalf of the root CA

3. Website TLS Certificate

Used to validate the website and HTTPS connection

The private key of an intermediate CA is considered extremely critical since it can be used to issue certificates that are accepted by those accepting that particular CA. This way, an adversary would be able to forge certificates for websites they have no control over.

Which Risks Did CERT-In Highlight?

CERT-In highlighted that once an attacker retrieved the compromised private keys, he/she could create a false certificate and then impersonate a legitimate website. In case the attacker was able to intercept traffic and the certificate was trusted by the client, it could lead to a man-in-the-middle (MitM) attack.

A MitM attack could allow an attacker to intercept or modify communications between the user and the website. However, it should be noted that the vulnerability did not imply that all the eMudhra certificates as well as all the encrypted web traffic were compromised.

Important clarification

As noted in the advisory, the compromise was related to the browser-trusted digital certificates for websites and online communication issued by eMudhra, while its digital signatures and eSign services regulated by the Controller of Certifying Authorities (CCA) under the Ministry of Electronics & Information Technology (MeitY) were safe.

Response of the Government and the Industry

Organization	Action Taken
Ministry of Electronics and Information Technology (MeitY)	Created a special task force to investigate the breach and coordinate with the involved parties.
CERT-In	Gave out an advisory regarding the breach and how to deal with it.
eMudhra	Conducted an investigation on the breach and the certificate keys, and started an investigation of the key generation process.
Mozilla	Stopped the use of affected certificates in Firefox and made updates to protect custom configurations of some of its users.
Google Chrome Security Team	Blocked affected certificate keys using the certificate-protection system of Chrome.

What Is CERT-In?

The Indian Computer Emergency Response Team (CERT-In) is the national level response organization for cybersecurity incidents in India, and functions under the Ministry of Electronics and Information Technology. It releases alerts, advisories, and guidance regarding cyber threats and vulnerabilities.

Its duties are as follows,

Collection and analysis of the cybersecurity incident information.
Releasing alerts and advisories on several vulnerabilities and threats.
Coordination of response activities for cybersecurity incidents.
Provision of mitigation guidance to affected organizations and individuals.

The Controller of Certifying Authorities (CCA) is another body operating under MeitY and having a different mandate relating to regulation of certifying authorities for digital signature certificates.