Mozilla and Google deployed emergency blocks on trust paths tied to eight intermediate certificate authority certificates issued by eMudhra after the company reported compromised private keys, while a Ministry of Electronics and Information Technology panel continued auditing how the keys were generated.
The Indian Computer Emergency Response Team said the private keys suffered from insufficient cryptographic randomness, allowing attackers who obtained the material to potentially impersonate affected websites. Government sources stressed that eMudhra’s India-regulated digital signature and eSign services overseen by the Controller of Certifying Authorities were not impacted, because that business operates under a separate compliance regime.
Enterprise impact
CERT-In’s advisory urged government agencies and large enterprises to refresh trust stores, rotate credentials served on affected chains, and monitor for man-in-the-middle attempts. Security teams said the incident was contained quickly for most Indian sites because major browsers auto-blocked the intermediates, but legacy applications with pinned certificates may need manual updates.
eMudhra shares fell sharply in the sessions after the disclosure as investors weighed litigation and audit costs. The company has not publicly detailed how the weak randomness entered its key-generation pipeline; MeitY sources cautioned against social-media speculation while the special team interviews engineers and reviews third-party hardware security modules.
Regulatory context
The breach lands amid tighter intermediary rules that require faster takedowns of unlawful content and more frequent user notices on synthetically generated media. While those IT Rules amendments focus on platforms, the eMudhra case shows how certificate trust underpins the same digital economy MeitY is trying to secure.
Chief information security officers said they are treating the event as a reminder to automate certificate inventory scans, not only for public websites but also for internal APIs that still rely on commercial CAs.
What site operators should do
Teams should confirm which certificate chains their properties use, reissue certificates from unaffected authorities if needed, and test mobile apps that bundle custom trust stores. CERT-In’s mitigation note includes logging guidance for suspicious TLS handshakes, particularly on government-facing portals ahead of state election activity.
MeitY said it remains engaged with eMudhra and global root programs until revoked certificates fully age out of cached trust lists worldwide.
Root program response
Browser vendors maintain their own root stores, so emergency distrust actions can propagate faster than national advisories alone. Security researchers said administrators should verify whether mobile apps embed custom trust anchors that will not auto-update with desktop browsers.
Insurance and legal teams at large IT services firms are reviewing contract clauses with eMudhra and alternate CAs to allocate liability if customer-facing sites suffered brief exposure windows.
Lessons for CCA-regulated services
Although digital signature certificates used for GST filings and income-tax returns were not affected, the incident highlighted how two businesses under one corporate brand can carry different risk profiles. Compliance officers said they are briefing boards on separating procurement of TLS certificates from regulated signature products even when sold by the same vendor.