eMudhra Keys Weakly Generated: Indian Websites Unaffected

India's Ministry of Electronics and Information Technology (MeitY) has established a special team to investigate a reported security incident impacting eMudhra's Public Key Infrastructure (PKI). While acknowledging that some intermediate authority keys were generated with process flaws on April 30, 2025, the ministry assured the public that the effect on Indian websites and applications was minimal and short-lived.

This incident primarily concerned eMudhra's international operations, specifically its global Transport Layer Security (TLS) and code-signing certificates. These are distinct from the Digital Signature Certificates and eSign services regulated by the Controller of Certifying Authorities (CCA) in India, which remain entirely unaffected. Google's Chrome and Mozilla's Firefox browsers have taken steps to block affected certificates after receiving a report on October 17, 2026. CERT-In has issued advisories for mitigation, with MeitY coordinating ongoing stakeholder efforts.