eMudhra security scare: Why Google, Apple and Mozilla moved to block certificates issued by this Indian firm

eMudhra, an Indian digital security company, is facing scrutiny after researchers found serious weaknesses in eight digital certificates linked to its website security services. The private keys behind these certificates were so weak that researchers could recover them in less than a second.

The weakness could have allowed attackers to create fake security certificates and make fraudulent websites appear genuine to internet browsers. In response, major technology companies, including Google, Apple and Mozilla, took steps to block the affected certificates.

However, eMudhra has said its Indian digital signature certificate (DSC) and eSign services remain unaffected.

What went wrong at eMudhra?

eMudhra provides digital signatures, electronic authentication and website security services. Its certificates help browsers check whether a website is genuine before establishing a secure connection.

These certificates work like identity cards for websites. They help browsers confirm that users are connecting to the correct server rather than a fake one.

On October 17, 2026, researchers identified a problem with eight intermediate Certificate Authority (CA) certificates linked to eMudhra's global website security business.

The private keys used to create these certificates reportedly lacked sufficient randomness, making them much easier to recover than they should have been.

Intermediate certificates help authorised organisations issue security certificates to websites. If an attacker obtains the private key of an affected certificate, they could potentially create fake certificates and use them to impersonate legitimate websites.

This could put users at risk by making unsafe websites appear trustworthy.

Why did Google, Apple and Mozilla act?

After the weakness was identified, major technology companies moved to stop browsers from trusting the affected certificates.

Google announced measures to block the affected intermediate certificates in Chrome and planned to remove the associated emSign ECC Root CA – G3 certificate from its trust store. Mozilla, Apple and Microsoft also took steps to block the affected certificates.

These actions are intended to prevent browsers from accepting potentially fraudulent certificates. However, some legitimate websites using the affected certificates could face security warnings or connection problems until they switch to replacement certificates.

What did eMudhra say?

The discovery has raised questions about whether people using eMudhra's digital signatures for official documents, tax filings and business transactions need to take any action.

The company has said its Indian DSC and eSign services are not affected. It has also stated that the problem is limited to eight intermediate certificates used in its global website security business, adding that its infrastructure was not compromised and no data breach occurred.

In a statement, eMudhra said it was investigating the issue involving eight intermediate certificates created during a key-generation process in April 2025.

“eMudhra is actively investigating a security incident involving a specific set of intermediate CA certificates created as part of a Key Generation Ceremony (KGC) conducted in April 2025 within its public trust infrastructure,” the company said.

MeitY to investigate the incident

The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate a security incident involving eMudhra’s digital certificate infrastructure, ANI reported, citing sources.

In a series of posts on X, MeitY said it had taken serious note of the incident but cautioned against fear-mongering on social media. The ministry clarified that the issue involved eMudhra’s internationally trusted digital certificate operations, which are separate from its domestic digital signature and eSign services.

According to MeitY, eMudhra operates in two distinct areas. The first involves issuing Digital Signature Certificates and providing eSign services, regulated by the Controller of Certifying Authorities (CCA) under the ministry.

The second involves issuing digital certificates trusted by major web browsers and operating systems. These certificates are used to secure websites, software and online communications.

MeitY said the special team would investigate the reported incident.