Indias Ministry of Electronics and Information Technology (MeitY) and cybersecurity watchdog CERT In have launched a thorough investigation after critical security weaknesses were discovered in Bengaluru based eMudhras global digital certificates.
The security alert was triggered after researchers found weak private keys linked to eight eMudhra global intermediate certificates that could potentially be reverse engineered using AI assisted techniques. If misused by cybercriminals, such compromised keys could allow hackers to perform website impersonation, intercept online communications through Man in the Middle attacks, or sign fake software.
Global tech majors took instant action to neutralize the threat. Google, Mozilla, Apple, Microsoft, and Cloudflare immediately blocked or distrusted the vulnerable certificate chains, with Google scheduling the total removal of the parent root key from Chrome by late October 2026. Crucially, the IT Ministry and eMudhra clarified that domestic Indian services are completely safe. eMudhras popular domestic Digital Signature Certificate (DSC) and eSign platforms run on an entirely separate infrastructure, remaining completely unaffected with zero data breaches or active exploitation detected.
Following global scrutiny, browser blocks, and rising compliance burdens, eMudhra announced a total voluntary exit from the global SSL/TLS web certificate business. The company noted that this international unit represented merely 1% of its overall revenue. Indian internet users and businesses can continue using domestic eSign and digital signature services without any concern.
