eMudhra Security Flaw: What Indian Consumers Need to Know

Digital certificates help browsers confirm that a website is genuine and that the connection is secure. Now, a recent security flaw involving eight intermediate certificates issued by the Bengaluru-based digital security firm eMudhra has raised concerns on safety and security of certificate generation.

What Went Wrong With eMudhra’s Digital Certificates?

eMudhra provides digital signature certificates and eSign services in India. These services can be used for digital transactions and tasks such as Goods and Services Tax (GST) filings and other tax-related documentation.

The flaw involved eight intermediate certificates used in eMudhra’s international website-security business. According to CERT-In, the cryptographic keys linked to these certificates were generated with insufficient randomness, making them possible to recover almost instantly. If recovered, the keys could have been used to create fake website certificates and impersonate legitimate websites.

CERT-In clarified that the weakness was in the key-generation process, not in the underlying P-384 cryptographic algorithm. eMudhra revoked all eight affected intermediate certificates on October 18, 2026. The company acknowledged the mistake through an update on October 26, 2026 and also apologised to customers, industry partners, and the wider Web-security community.

“The flaw was ours. A script error resulted in issuing CA’s with weak keys. We want to apologise directly to our customers and to the broader WebPKI community, both of whom were entitled to expect better from us. Also to our partners, who have had to field questions that are ours to answer,” eMudhra’s leadership team said.

According to eMudhra, the affected intermediate certificates had not issued publicly trusted end-entity certificates. CERT-In’s advisory also said that as on October 21, publicly available information had not established confirmed malicious exploitation of the flaw.

Are Indian Users’ Digital Signatures and eSign Services Safe?

While the incident raised questions about the security of digital certificates, it is important to distinguish between eMudhra’s international website-security business and its services in India.

Digital signature certificates and eSign services in India are regulated by the Controller of Certifying Authorities under the Ministry of Electronics and Information Technology (MEITY). CERT-In has specifically clarified that these services were not affected by the reported flaw. “The issuance of digital signature certificates and eSign services, regulated by the Controller of Certifying Authorities (CCA) under MEITY, are not impacted,” CERT-In said.

This means the incident does not, by itself, indicate that Indian users’ digital signatures or eSign services have been compromised. The reported weakness was linked to a separate set of certificates used in international website security.

What Is eMudhra Doing After the Security Flaw?

eMudhra has also outlined steps to help its affected international customers move to alternative arrangements. In its October 28 update, the company said around 30,800 certificates issued under the affected certificate hierarchies belonged to a customer ecosystem in the US. It said the customer had been provided an alternative route for issuing certificates during the transition.

The company is working with browser and certificate-store operators on the transition. It has also said it plans to voluntarily wind down its publicly trusted global TLS certificate business.

According to eMudhra, its digital signature, eSign and enterprise services remain unaffected.

What Should Users Do?

CERT-In has advised users to keep their browsers, operating systems and apps updated and avoid bypassing certificate-security warnings. Users should also ensure their devices receive updated certificate-security information. Organisations should check whether their systems rely on affected certificates, replace them where required, and monitor for suspicious certificate activity.

For Indian consumers, the key distinction is that the reported flaw involved eMudhra’s international website-security certificates. CERT-In has clarified that regulated Indian digital signature and eSign services were not affected.