|
The Ministry of Electronics and Information Technology (MeitY) has said the security incident involving eMudhra's global digital certificate infrastructure had a limited, short-lived impact on Indian websites and applications, as it constituted a special team to investigate the matter.
In a series of posts on X, the ministry said it had taken serious note of the reported incident and was working with stakeholders to resolve the matter. It also clarified that eMudhra's Digital Signature Certificate (DSC) and eSign services regulated by the Controller of Certifying Authorities (CCA) under MeitY remained completely unaffected. The impact of this incident on Indian websites and applications has been very limited and for a very short interval, the ministry said. MeitY said eMudhra operates in two distinct areas. The first covers the issuance of digital signature certificates and eSign services regulated by the CCA, while the second involves digital certificates trusted by major browsers and operating systems to secure websites, software and online communications. The ministry clarified that the reported incident relates only to the second function, which operates internationally under a global trust framework and is subject to independent audits, including WebTrust audits conducted by BDO International Limited. MeitY said it was not involved in auditing this part of eMudhra's operations. The clarification follows a security incident involving eight intermediate digital certificates issued under eMudhra's global Public Key Infrastructure (PKI), used to establish trust in digital certificates and secure online connections. The issue came to light on October 17 after a researcher alerted Google and other technology companies that private keys associated with the certificates were vulnerable. Google and Mozilla subsequently moved to block the affected certificates. eMudhra said all eight affected intermediate certificates were revoked on October 19 and that none had issued customer certificates. The company also said its infrastructure was not compromised and no data breach had occurred. MeitY said the Indian Computer Emergency Response Team (CERT-In) had issued an advisory on the incident, including mitigation measures. The ministry said further details would be shared after the investigation is complete, while it continues to engage with stakeholders to resolve the matter. (ANI)
|
