Recently, eMudhra, a private digital certificate company based in India, discovered a critical security flaw in its international web security business. The company, which issues digital certificates and services, had to address the issue to prevent any potential damage to user data and internet security. The discovery was a wake-up call for both eMudhra and the tech giants that rely on its services, including Google, Mozilla, Apple, and Microsoft.
The critical flaw in eMudhra's digital certificates led to a significant response. Major tech companies blocked the affected certificates, rendering them unusable. This action by Google, Mozilla, Apple, and Microsoft highlighted the severity of the issue and the potential risks to internet security. The blocking of these certificates meant that any website or service using eMudhra's certificates would face connectivity issues, impacting user trust and the overall reliability of the internet.
In the wake of the eMudhra incident, the Indian government took action. A special team was formed to investigate the case, with the government expressing its support for the investigation. The government's stance was clear: the security of digital certificates is a critical issue that requires attention. The investigation aimed to uncover the root cause of the flaw and ensure that such incidents do not occur in the future.
The eMudhra incident raises significant questions about the security of digital certificates and the potential risks to user data.
eMudhra's response to the crisis involved acknowledging the flaw and taking steps to rectify the situation. However, the critical nature of the flaw and the actions taken by major tech companies highlighted the severity of the situation. eMudhra faced scrutiny from both the tech community and the government, with the company's reputation and future in digital security under review.
A security incident concerning eMudhra’s Public Key Infrastructure (PKI) was reported in the public domain. Meity has taken serious note of the reported incident. A special team has been constituted to investigate the matter.
The eMudhra incident raises significant questions about the security of digital certificates and the potential risks to user data. Digital certificates are the backbone of secure internet communications, and any flaw can have far-reaching consequences. The blocking of eMudhra's certificates by major tech companies underscores the importance of robust security practices in the digital certificate industry. The incident also highlights the interdependence of the tech ecosystem, where the failure of one company can impact the entire internet.
The special team formed by the Indian government is currently investigating the eMudhra incident. The investigation is focused on understanding the root cause of the flaw and ensuring that similar incidents do not occur in the future. The government's support for the investigation is a clear indication of the seriousness of the issue. The team's findings will be crucial in shaping the future of digital certificate security in India and beyond.
#WATCH | eMudhra security incident | eMudhra Co-Founder Kaushik Srinivasan says, "This was not a security breach in the sense of a true security breach. There was no infrastructure breach or data breach or anything. This was admittedly a human error caused by a script, a sort of error that happened on April 30th, 2025, where these weak keys were created on hardware. But then the key strength was kind of weak. So it was not an infrastructure or a data breach. It was more a question of keys having sizes that were not essentially strong enough. So it could be easily kind of mathematically computed..." He further adds, "...This key generation ceremony is a routine process for our team that has been performing it for several years. On that specific day, this lapse happened. Adequate human error checking and manual maker-checker controls were not present; as a consequence of this, this kind of thing happened... We are cooperating with the browser programs. We're responding to any questions that have come. We are also reaching out to customers who are impacted directly by this operation because our ECC route is distrusted. So there's a US customer that is kind of impacted..."
The eMudhra incident serves as a reminder of the critical importance of robust security practices in the digital certificate industry. As the investigation continues, the broader implications for internet security and user data will be closely watched. The incident has highlighted the need for greater scrutiny and accountability in the digital certificate sector, ensuring that the internet remains a secure and reliable platform for all users.