Representative image. BalticServers.com, CC BY-SA 3.0, Wikimedia Commons
Why it matters
Certificates are what let your browser trust that a bank or government website is genuine. A weak key at a trusted authority could, in theory, let someone impersonate any site, so the fix depends on browsers and devices being updated. Keeping your phone and browser current and never ignoring certificate warnings is the practical protection, CERT-In said.
A flaw in how Bengaluru-based eMudhra Ltd created eight of its web security keys has led Google, Mozilla, Apple and Microsoft to stop trusting the affected certificates. The Ministry of Electronics and Information Technology (MeitY) said on 21 October 2026 that it had set up a special team to investigate, while the national cyber agency CERT-In asked organisations and users to update their systems.
The company and the ministry both say there is no sign the eMudhra keys were misused, and that India’s digital signature and eSign services are not affected.
What went wrong with the eMudhra keys
Websites prove who they are with certificates, small digital ID cards that a browser checks before showing the padlock. A handful of trusted firms, called certifying authorities, sign these certificates using secret private keys. eMudhra is one of them, and its “intermediate” certificates sat in the trust lists of the big browsers.
Each private key should be a random number so large that guessing it is practically impossible. According to The Hindu, the eight eMudhra keys were instead tiny numbers between 1 and 256, and one of them was simply 4. Hindustan Times reported that anyone could have worked them out in seconds. An anonymous researcher spotted the problem and alerted browser makers over the past few days.
Mozilla, which makes Firefox, wrote in its incident report that the impact “could not be higher”, because even people with little technical skill could recover the keys. Whoever held such a key could, in theory, issue a fake certificate for any website, from a bank to a government portal. Six of the eight certificates were for website encryption and were trusted by Chrome, Firefox, Microsoft and Apple, Mozilla’s Dennis Jackson told The Hindu.
What eMudhra and the government have said
eMudhra said a fault during its key generation ceremony on 30 April 2025 produced a second, weak set of keys alongside the strong ones, and the weak set was the one published to browser trust lists. The company said its systems were not breached, no data was lost, it has revoked the certificates, and only one of the eight was ever used in production. None of them issued certificates to any website, it said.
MeitY said the impact on Indian websites and apps had been “very limited and for a very short interval”. It said digital signature certificates and eSign, which the Controller of Certifying Authorities regulates, were unaffected, and it accused some social media accounts of fear mongering.
CERT-In’s advisory, issued on Wednesday afternoon, took a sharper tone. It said attackers could use such keys to intercept or alter communications, which could lead to stolen passwords, leaked data and financial fraud. Hindustan Times noted that the keys could have been exploited at any time since April 2025, and that a forged certificate used against devices that skip public certificate logs would leave no public trace.
Why the eMudhra flaw matters beyond one company
Any trusted certifying authority can vouch for any website, so one firm’s mistake can expose sites that never used it, security experts told Hindustan Times. Several Indian government sites, including UIDAI, which issues Aadhaar, and the income tax filing portal, use eMudhra certificates or other technology from the company, The Hindu reported.
Investors reacted quickly. eMudhra’s shares fell about 20% in Wednesday’s trade, Business Standard reported.
Major browsers also log every certificate they accept in public records called Certificate Transparency logs, which would show a fake one being used against their users. That safeguard is why experts see the risk for ordinary phone and laptop users as lower than for older routers, payment terminals and software that are rarely updated.
What users and website owners should do now
CERT-In asked government departments, internet providers, software makers and website administrators to update their systems and their lists of trusted certificates. For ordinary users, its main advice was simple: keep your browser and phone software updated, and never click past a certificate warning or switch off certificate checks.
MeitY’s special team has not said when it will report. The episode follows the SBI customer data leak earlier this week, another reminder that the safety of Indian online services depends on behind-the-scenes systems most people never see. The CERT-In advisory is listed on the agency’s official website.
Frequently asked questions
Is my Aadhaar or eSign affected by the eMudhra flaw?
MeitY and eMudhra said digital signature certificates and eSign services run separately and are unaffected. The flaw involved certificates used for website security.
Were the eMudhra keys misused?
There is no evidence so far that they were misused, according to the company and reports. Major browsers log certificates publicly, which would expose fakes used against their users.
What should I do to stay safe?
CERT-In advised keeping browsers and operating systems updated and never bypassing certificate warnings or turning off certificate checks.
Who is investigating?
MeitY has set up a special team to investigate the incident. It has not said when it will report.