Eight eMudhra web security keys used by the government. and PSU leaked

Eight private keys used to issue web security certificates by eMudhra Ltd have been leaked. based in Bengaluru, which sent security teams from major Internet browser and operating system developers around the world scrambling to patch their systems to stop trusting the affected certificates.

Also Read: Data Breach: SBI admits exposure of its customer data on dark web

The extraordinary development comes as several government websites use a series of eMudhra keys to “sign” their security certificates, which is practically necessary to view any website in a modern browser.

According to an anonymous researcher who alerted large Internet infrastructure companies in recent days, these “intermediate” security certificate keys had a glaring flaw. The discovered bug boiled down to this: instead of using a 384-bit private key, these intermediate certificates only had a numeric key that was between 1 and 256, making them orders of magnitude easier to derive. Public key cryptography, such as that used in web security certificates or SSL certificates, relies on private keys remaining unknown to any outside parties at all times. One of the keys was precisely the number 4, which was preceded by 383 zeros.

The Ministry of Electronics and Information Technology (MeitY) said in a statement shared with The Hindu that it has “taken serious note of the reported incident” and that “a special team has been constituted to investigate the matter”.

The ministry added that “social media accounts are capitalizing on fear-mongering about the impact of this incident” and said that the issuance of the website’s security certificates was “international in nature and operates within a global trust framework” and that “the reported security incident is only related to this one”. The IT ministry was not involved in the audit of this part of eMudhry’s operations, it said.

“The impact of this incident on Indian websites and apps was very limited and for a very short interval,” MeitY said. “It is important to note that digital signature certificates and electronic signature services regulated by the Controller of Certification Authorities (CCA) remain completely unaffected by this incident,” the ministry added.

Dennis Jackson, who was involved in Mozilla’s response to the incident, said that eMudhra’s private keys were “trivial to exploit”, adding that “6 of the affected certificates are for TLS and Chrome, Mozilla, Microsoft and Apple trusted roots”. eMudhra has revoked the affected certificates.

“After learning of the incident, eMudhra initiated its incident response procedures, took measures to contain the affected certificates, and began working closely with browser and root repository operators to protect users and maintain the integrity of the broader WebPKI ecosystem,” eMudhra said in an update posted on its website.

“Importantly, none of the affected intermediate CAs have been deployed in production, with the exception of one,” eMudhra said, without identifying which one it was. “Furthermore, none of these intermediate CAs, including the one deployed in production, issued any end-entity certificates. This was confirmed by our internal analysis and confirmed by Certificate Transparency’s publicly available records.”

In a subsequent statement filed with the exchanges, eMudhra said: “A bug in (the Key Generation Ceremony) caused a packaging/unpacking step that created a second set of weak keys alongside the original strong keys. He added: “The weak keys were those published in the browser’s root repositories. eMudhra is working to determine the root cause.”

Yash Kakadia, founder of cybersecurity firm Security Brigade, said the impact of the leak, even if patched for browsers, could spread to Internet of Things (IoT) devices, which are not often patched to address similar incidents of certificate compromise. “The cleanup could be huge, especially for equipment and software that can’t be easily updated,” Mr Kakadia said.

Many government websites, including Aadhaar issuer UIDAI and the tax return filing portal, use eMudhra certificates or other technology from the firm.

Also Read: In push for Made-in-India browser, mandate to trust government encryption

There is no indication that eMudhra’s root certificates themselves—which are above the level that was leaked—have been compromised. Global browsers have been reluctant to trust India’s root CAs since the National Information Center’s root authority issued “rogue” certificates in July 2014. eMudhra is India’s only root CA that is trusted globally.

In 2023, MeitY launched the Indian Web Browser Development Challenge to request the development of a made-in-India browser that would trust the CCA root certification authorities that today’s major web browsers block. Ulaa of Zoho Corp won the challenge and won ₹1 million.

Published – 21 Oct 2026 11:32 IST