eMudhra Private Key Leak Triggers Global Browser Patches
Eight private keys from Indian certificate authority eMudhra were exposed on October 20, 2026, enabling potential man-in-the-middle attacks on government and banking sites. The incident prompted an advisory from India’s CERT-in and immediate patches from major web browser developers. Because eMudhra operates a trusted root CA, the leak compromises trust in SSL certificates globally, requiring users to verify browser updates to maintain secure web connections.
Key points
- eMudhra Ltd, a Bengaluru-headquartered certificate authority, exposed eight private keys used to sign intermediate SSL certificates on October 20, 2026.
- The leak allows attackers to issue fraudulent certificates, enabling man-in-the-middle attacks where user traffic is intercepted and redirected to malicious sites.
- India’s Computer Emergency Response Team (CERT-in) issued an advisory, while major web browser developers released immediate patches to mitigate the risk.
- eMudhra’s services are widely used by Indian government and public sector bank websites, making the breach significant for domestic digital infrastructure.
- The incident highlights the fragility of the global web trust model, which relies on a small number of root certifying authorities to validate website identities.
- Users must update their browsers to ensure they trust the patched certificate chains, preventing interception of secure communications.
A significant security breach has emerged involving eMudhra Ltd, a Bengaluru-based certificate authority responsible for issuing SSL certificates to numerous government and public sector bank websites in India. On October 20, 2026, it was revealed that eight private keys used to sign intermediate certificates had been exposed. These keys are critical components of the cryptographic system that verifies website identities, and their exposure allows attackers to create fraudulent certificates that browsers may still trust.
The breach has immediate implications for web security, as it enables man-in-the-middle attacks where user traffic can be intercepted and redirected to malicious sources. Because the internet relies on a small number of trusted root certifying authorities, a leak in one of these entities can have widespread effects. In response, India’s Computer Emergency Response Team (CERT-in) issued an advisory, and major web browser developers released patches to update their trust stores and mitigate the risk.
For global users, the incident underscores the importance of keeping browsers updated to ensure they recognize the corrected certificate chains. While the breach primarily affects sites using eMudhra’s services, the underlying mechanism of trust in web security means that any compromise in a root CA can ripple through the ecosystem. Analysts note that this event may prompt a broader review of how private keys are managed and protected within the certificate authority hierarchy.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
