|
The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate a security incident involving eMudhra's digital certificate infrastructure, which prompted major technology companies to block affected certificates over concerns about online security, according to sources.
The Ministry has taken serious note of the incident but clarified that Digital Signature Certificates (DSCs) and eSign services regulated in India remain completely unaffected. Bengaluru-based eMudhra is a listed digital identity and cybersecurity solutions company that provides digital signatures, electronic authentication and security certificates to businesses, financial institutions and governments. Its services enable individuals and companies to digitally sign documents, verify identities and secure online transactions and communications. The incident involves eight intermediate digital certificates issued under eMudhra's global Public Key Infrastructure (PKI), a system used to verify the identity of websites and establish secure internet connections. The security flaw came to light on October 17, when a researcher alerted Google and other major technology companies that private keys associated with the eight certificates were vulnerable. According to Google's Chrome and Android Security Teams, the keys were generated with insufficient randomness, potentially allowing attackers to create fraudulent HTTPS certificates and impersonate legitimate websites. Following the disclosure, Google and Mozilla moved to block the affected certificates. Google also announced that it would remove the associated root certificate from Chrome's trusted list starting October 27, potentially affecting websites still relying on it. However, MeitY sources clarified that the reported incident relates only to eMudhra's international digital certificate business, which operates under a global trust framework and undergoes independent audits, including WebTrust audits conducted by BDO International Limited. "The impact of this incident on Indian websites and applications has been very limited and for a very short interval," sources said. The Ministry also clarified that eMudhra's Digital Signature Certificate and eSign services, regulated by the Controller of Certifying Authorities under MeitY, operate separately and remain unaffected. Meanwhile, eMudhra, in an official statement issued on Wednesday, acknowledged that a flaw during a key-generation process conducted on April 30, 2025, had resulted in weak cryptographic keys being published. "A flaw in the KGC caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores," the company stated. eMudhra said all eight affected intermediate certificates were revoked on October 19 and that none had issued customer certificates. The company also maintained that its infrastructure had not been compromised and no data breach had occurred. It further clarified that the affected global TLS business accounts for around 1 per cent of its revenue, although the incident could carry reputational risks that cannot yet be quantified. "The global TLS business runs on infrastructure that is completely separate from the India DSC business. DSC and eSign services in India are running normally," the company said. The Indian Computer Emergency Response Team (CERT-In) has also issued an advisory outlining mitigation measures, according to MeitY sources. The Ministry remains engaged with stakeholders to resolve the matter at the earliest, while further details will be shared following the completion of the investigation. (ANI)
|
