India's eMudhra Discloses Compromise of Eight Root Certificate Keys
eMudhra, India's primary digital certification authority, confirmed that eight private keys used to validate secure website connections have been compromised. The disclosure followed an advisory from India's cybersecurity regulator, CERT-In. As eMudhra issues over 60 million certificates for major enterprises and government sites, the breach raises global concerns about the integrity of web security infrastructure and the potential for man-in-the-middle attacks on trusted digital identities.
Key points
- eMudhra, a Bengaluru-based digital certification authority founded in 2008, confirmed that eight private keys associated with its security certificates were compromised.
- The disclosure was prompted by an advisory from CERT-In, the Indian Computer Emergency Response Team, which monitors national cybersecurity threats.
- The company, which issued over 60 million certificates by 2022-23, serves major clients including Infosys, TCS, and various government websites.
- eMudhra, launched by IT firm 3i Infotech, is the sole Indian root certificate authority trusted globally for validating website authenticity in modern browsers.
- The breach impacts the trust chain for digital signatures, potentially allowing attackers to impersonate secure sites if the compromised keys are exploited.
- The company had recently raised ₹412.80 crore in its 2022 IPO, highlighting its significant role in India's digital infrastructure.
eMudhra, the leading digital certification authority in India, has revealed that eight private keys used to secure its digital certificates have been compromised. The disclosure, which underscores the fragility of global web security infrastructure, followed an advisory from CERT-In, the Indian Computer Emergency Response Team. As a root certificate authority, eMudhra plays a critical role in validating the authenticity of websites for modern browsers, meaning a breach in its key management could have far-reaching implications for digital trust.
Headquartered in Bengaluru, eMudhra was launched in November 2008 by IT firm 3i Infotech to provide affordable digital signature services. The company became India’s first eSign Service Provider in 2015 and has since issued over 60 million certificates. Its client base includes major technology and industrial firms such as Infosys, TCS, Larsen & Toubro Infotech, and Hindalco Industries, alongside numerous government websites that rely on its keys to sign security certificates.
The compromise of these private keys raises questions about the potential for man-in-the-middle attacks, where an attacker could intercept and modify secure communications without user awareness. eMudhra’s status as the sole Indian root CA trusted globally amplifies the significance of this incident. The company recently completed a ₹412.80-crore IPO in May 2022, which was subscribed 2.72 times, reflecting strong investor confidence in its digital infrastructure role. As eMudhra works to remediate the issue, the incident serves as a reminder of the centralized risks inherent in global certificate management systems.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
