eMudhra security incident: MeitY orders probe, says impact on Indian websites and apps was limited; details here
The Ministry of Electronics and Information Technology (MeitY) on Wednesday, 21 October, constituted a special team to investigate a security incident involving eMudhra’s Public Key Infrastructure (PKI), while maintaining that its impact on Indian websites and applications was limited.
The incident came to light after concerns emerged over the compromise of eight intermediate Certificate Authority (CA) certificates associated with eMudhra. These certificates form part of the digital trust infrastructure used to authenticate websites and secure online communications.
In a series of posts on X, MeitY said it had taken serious note of the incident but cautioned against fear-mongering on social media. The ministry clarified that the incident concerned eMudhra’s internationally trusted digital certificate operations, which are separate from its domestic digital signature and eSign services.
The ministry said the impact on Indian websites and applications had been very limited and lasted for a short interval. It added that CERT-In had issued an advisory outlining mitigation measures.
What MeitY said about the eMudhra security incident
According to the ministry, eMudhra operates in two distinct areas, each governed by a different regulatory framework.
The first involves issuing Digital Signature Certificates (DSCs) and providing eSign services. These activities are regulated by the Controller of Certifying Authorities (CCA) under MeitY.
The second involves issuing digital certificates trusted by major internet browsers and operating systems. These certificates are used to secure websites, software and online communications.
MeitY clarified that the reported security incident concerned only the second area of operations.
This function is international in nature and operates under a global trust framework. It is governed by international standards and subject to independent audits, including WebTrust audits conducted by BDO International Limited.
The ministry also clarified that it is not involved in auditing this international certificate-issuing operation.
The distinction is significant because eMudhra’s domestic digital signature and eSign services operate under a separate regulatory framework. The ministry did not identify these services as being affected by the reported incident.
“However, some social media accounts are indulging in fear mongering about the impact of this incident,” MeitY said in its statement.
How were Indian websites and applications affected?
MeitY said the incident had a very limited impact on Indian websites and applications, lasting only a short period.
However, the ministry did not disclose the number of affected websites or applications, the precise duration of the impact, or the full technical findings of the investigation.
Public Key Infrastructure is used to establish trust between websites, users and digital services through cryptographic keys and digital certificates.
These certificates help browsers verify website identities and establish encrypted connections. A compromise involving certificate infrastructure can potentially undermine that trust and expose online communications to security risks.
CERT-In has issued an advisory concerning the incident, outlining mitigation measures for affected systems.
MeitY said it remained engaged with all stakeholders to resolve the incident at the earliest.
The ministry’s clarification indicates that the reported incident was confined to eMudhra’s internationally trusted digital certificate operations and did not concern the company’s separately regulated domestic digital signature and eSign services.
However, the complete technical impact and circumstances surrounding the incident remain subject to investigation.
“Further details will be shared upon completion of the investigation,” the ministry said.
