Govt forms special team to investigate eMudhra digital .

CERT-In said insufficient cryptographic randomness had compromised private keys, potentially allowing attackers to issue fraudulent certificates and impersonate websites

The Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the leak of private keys associated with web security certificates issued by Bengaluru-based eMudhra.

In a post on X, the IT ministry said it had taken “serious note” of the incident and would look into the matter.

“Meity remains engaged with all the stakeholders to resolve this incident at the earliest. CERT-In has also issued an advisory in r/o the incident, including the mitigation measures,” the ministry said.

Founded in 2008, eMudhra has issued more than 60 million digital certificates to date.

A limited number of certificate authorities worldwide issue digital certificates under a global trust framework. Based on certificates issued by such authorities, web browsers determine whether a website can be trusted and establish secure connections.

Earlier in the day, the Indian Computer Emergency Response Team (CERT-In) issued an advisory cautioning that private keys used for eMudhra’s digital certificates had been “generated with insufficient cryptographic randomness”, leading to their compromise.

“An attacker who recovers these private keys could issue fraudulent certificates for domains they do not control. Such TLS certificates could be used to impersonate legitimate websites and facilitate man-in-the-middle attacks, potentially enabling the interception or modification of encrypted communications where an attacker can intercept the network traffic and the affected certificate chains remain trusted by the client,” CERT-In said in its advisory.

The issue came to light after web browser company Mozilla published a report stating that private keys associated with eight eMudhra intermediate certificates had been compromised.

“Upon becoming aware of the incident, eMudhra initiated its incident response procedures, took measures to contain the affected certificates, and began working closely with browser and root-store operators to safeguard users and maintain the integrity of the broader WebPKI ecosystem,” eMudhra said in a statement.

The company said it was “conducting a thorough investigation” into the leak and the circumstances that led to the private keys being compromised.

“We are conducting a thorough investigation into the circumstances surrounding the incident and reviewing our security controls and operational procedures to identify and implement any necessary improvements,” eMudhra said.

Disclaimer: Moneywealth research provides stock market news for informational purposes only and should not be construed as investment advice. Readers are encouraged to consult with a qualified financial advisor before making any investment decisions.

SEBI registered research analyst

Stock market

Accurate intraday tips

Call or whatsapp: +91 7096190322

www.moneywealth.co.in