A critical cryptographic security exposure involving eight intermediate digital certificates has impacted eMudhra, one of India's prominent licensed certifying authorities. Addressing the development, the Indian Computer Emergency Response Team issued an official advisory on October 21, 2026. The vulnerability originated from weak cryptographic randomness within system coding, which led to the private cryptographic keys becoming compromised and exposed to potential risk.
Scope of the Exposure and Technical Risks
Technical assessments revealed that the incident involved the private cryptographic keys of eight intermediate certificates, specifically encompassing six TLS certificates and two code-signing certificates. In internet infrastructure, these cryptographic keys function as the verifiable proof of identity and authenticity for websites and software packages. Had these private keys fallen into unauthorized hands, malicious actors could have generated counterfeit digital certificates that appeared entirely legitimate under the identity of financial entities, corporate platforms, or administrative websites. Such credentials would enable attackers to deploy convincing replica portals capable of capturing sensitive user credentials and private financial information.
The Operational Role of eMudhra in Internet Security
eMudhra occupies a central position within India's digital security framework as an authorized certifying authority. Its digital signature certificates and eSign infrastructure are extensively deployed across crucial administrative and corporate workflows, including the filing of income tax returns, participation in government e-tenders, and formal document authentications. Furthermore, the entity plays a fundamental role in issuing SSL and TLS certificates that establish encrypted connections between web servers and end-user browsers.
Timely Mitigation and Responses by Global Platforms
Despite the severity of the cryptographic lapse, proactive monitoring allowed the issue to be detected before direct exploitation occurred. According to information released by the Indian Computer Emergency Response Team, eMudhra clarified that no end-user certificates had been generated from the impacted intermediate certificates for general customers. Google independently confirmed that prior to blocking the six affected TLS certificates, no evidence of misuse or anomalous digital footprints had been identified across global networks.
In response to the risk, major browser maintainers introduced targeted enforcement measures. Mozilla acted immediately by blocking the compromised TLS certificates and deploying dedicated software updates across the Firefox ecosystem. Simultaneously, Google reinforced security filters within the Chrome browser and initiated procedures to remove the 'emSign ECC Root CA – G3' root certificate from the Chrome root store environment.
Technical Recommendations Issued by Cyber Authorities
To prevent secondary vulnerabilities across local networks and organizational IT setups, the Indian Computer Emergency Response Team directed internet users and system administrators to adopt concrete technical precautions
- Update web browsers, operating systems, and critical enterprise applications immediately to their most recent security versions.
- Audit and re-verify the active validity and deployment status of all digital certificates utilized across websites and internal servers.
- Revoke and replace any compromised intermediate certificates with verified credentials issued by trusted, secure authorities.
- Pay strict attention to browser alerts, ensuring that security prompts or warning banners are never bypassed.
- Maintain systematic log monitoring to identify unauthorized alterations or anomalous activities within website directories and software codebases.
