eMudhra weak-key flaw: browsers block 8 certificates; what it means for India’s web trust
Next story · 22 OctEmissions Gap Report 2026 ‘The Point of Return’: 1.5°C will be crossed, but can be regained by 2100
Google, Mozilla, Apple and Microsoft have blocked eight intermediate certificates of Bengaluru-based eMudhra, India’s largest certifying authority, after a researcher found their private keys were tiny numbers between 1 and 256 instead of proper 384-bit keys. eMudhra revoked them, CERT-In issued an advisory on 21 October 2026 and MeitY set up a special team. India’s regulated digital signatures and eSign are unaffected.
- Certificates hit
- 8 (6 web, 2 code-signing)
- Reported
- 17 Oct 2026
- Key size flaw
- 1–256 vs 384-bit
- Advisory
- CERT-In, 21 Oct
eMudhra key flaw: what happened?
Every time you see the padlock in your browser, you are trusting a chain of digital certificates. This week one link in that chain, from an Indian company, turned out to be dangerously weak.
- A researcher reported on 17 October that eight eMudhra intermediate CA keys were generated with too little randomness (Indian Express).
- One key was just the number 4, padded with zeros (The Hindu).
- Chrome and Firefox blocked them without users needing to update; Apple and Microsoft followed.
- eMudhra traced it to a key-generation exercise of 30 April 2025; only one key was in production and none had issued end-user certificates.
- MeitY: Digital Signature Certificates and eSign regulated by the Controller of Certifying Authorities (CCA) are unaffected.
How do web certificates work?
- A Certificate Authority (CA) vouches that a website is who it claims to be.
- The chain: root CA → intermediate CA → website certificate.
- Security depends on the CA’s private key staying secret and hard to guess.
- eMudhra is the only Indian root CA trusted globally by browsers (The Hindu).
Two different certificate systems
| Point | Web (TLS) certificates | Indian digital signatures |
|---|---|---|
| Use | HTTPS padlock, code signing | Signing documents, e-filing, eSign |
| Trust set by | Browser and OS root programs | Controller of Certifying Authorities |
| Legal basis | Global industry rules | IT Act, 2000 |
| Hit by this flaw? | Yes, 8 intermediate certificates | No |
Which legal provisions apply?
- IT Act, 2000: Section 17 creates the Controller of Certifying Authorities; CAs are licensed under Section 21.
- Section 70B: CERT-In is the national agency for cyber incidents; its 2022 directions require reporting within 6 hours.
- Digital Personal Data Protection Act, 2023: data fiduciaries must report personal data breaches.
- Separately, SBI confirmed that data of 3,897 customers surfaced on the dark web (Indian Express).
What are the challenges?
- One weak CA can let attackers fake websites or sign malware.
- Devices that are rarely updated, like IoT gear, may keep trusting bad certificates.
- Global browsers have distrusted Indian roots since rogue certificates from NIC’s CA in 2014.
- Many government sites, including UIDAI and the income-tax portal, use eMudhra products.
What should be done next?
- Independent audits of key-generation ceremonies at all Indian CAs.
- Faster disclosure and certificate-transparency monitoring by CERT-In.
- Plan replacement certificates for government sites quickly.
- Enforce DPDP rules on breach reporting across banks and PSUs.
What can Prelims ask on digital certificates?
- CCA: set up under the IT Act, 2000; licenses CAs in India.
- CERT-In: under MeitY; Section 70B of the IT Act.
- TLS: protocol that encrypts web traffic (HTTPS).
- eSign: Aadhaar-based online signature service.
- Zoho’s Ulaa won MeitY’s Indian Web Browser Development Challenge.
How to write about digital trust in Mains
Practice question (10 marks, 150 words): Trust is the foundation of the digital economy. In light of recent incidents, suggest measures to secure India’s digital trust infrastructure. (GS-III)
- Intro: eMudhra certificate flaw and SBI data exposure, Oct 2026.
- How trust works: CAs, keys, browsers.
- Gaps: audits, patching, breach reporting.
- Measures: audits, CERT-In monitoring, DPDP enforcement.
- Conclusion: trust needs process, not only technology.
Image: Network cables plugged into a switch. ProjectManhattan, Wikimedia Commons, CC BY-SA 3.0
How to use this in Mains
If asked: Discuss the challenges to India’s cyber security architecture. (GS-III)
Quote: “A lapse at even one certification authority could undermine this system, potentially allowing attackers to create fraudulent digital certificates.”
Use it: Use it to show how one weak link threatens all.
If asked: Evaluate India’s legal framework for data breach reporting. (GS-III)
Quote: “The impact of this incident on Indian websites and applications have been very limited and for a very short interval.”
Use it: Quote MeitY’s view, then argue for transparent audits.
Exam angle
Prelims: CCA, CERT-In, TLS, eSign. · Mains GS-III: cyber security, digital trust, data protection.
Practice MCQs
Original practice questions (not PYQs).
In India, Certifying Authorities that issue Digital Signature Certificates are licensed by the
Answer (b) & explanation
The CCA, created under the IT Act, 2000, licenses and regulates CAs.
Consider the following statements:
1. CERT-In functions under the Ministry of Electronics and Information Technology.
2. CERT-In derives its statutory role from Section 70B of the IT Act, 2000.
Which of the statements given above is/are correct?
Answer (c) & explanation
Both are correct.
The ‘padlock’ shown in a web browser’s address bar mainly indicates that
Answer (b) & explanation
It signals a TLS-encrypted connection with a certificate the browser trusts; it does not guarantee the site is safe.
Questions students ask about this
What went wrong at eMudhra?
Eight intermediate CA keys were generated with too little randomness, making them easy to guess.
Are Indian digital signatures affected?
No. MeitY says CCA-regulated DSCs and eSign are unaffected.
Who blocked the certificates?
Google, Mozilla, Apple and Microsoft.
What should website owners do?
Replace certificates chaining to the affected CAs and update trust stores, as CERT-In advised.
Keep studying
Go deeper
facts from cited sources only; faculty review pending