What does eMudhra’s web security key leak mean for internet users? | Explained

You don’t have any Active Subscription.

Subscribed with another email? Logout and Login with that one.

Your active subscription(s)

Account subscription benefits alongside Premium Stories, Editorials, Opinions and more. Unlock these with Subscription

Products you've access to

Additional Subscription Benefits

Need help with your subscription?

Published - October 22, 2026 09:56 am IST

A private key is part of a cryptographic pair in secure communications, with a public key being used in combination with it to create a message that disallows interception. | Photo Credit: Getty Images/istockphoto

The story so far: Eight private keys used to issue web security certificates by Bengaluru-headquartered eMudhra Ltd were exposed, it emerged on Tuesday (October 20, 2026). The incident has prompted an advisory by the Computer Emergency Response Team, India (CERT-in) and immediate patches from developers of major web browsers. eMudhra’s services are used across several government and public sector bank websites.

The internet relies on a small number of so-called “root” certifying authorities (CAs) who can then authorise intermediate CAs to issue SSL certificates for webpages. Those SSL certificates are on practically every website, acting as an assurance that a website is what it claims to represent. This system works on trust, and only a handful of root CAs are trusted by browsers around the world. eMudhra operates one of these trusted CAs.

CAs use a private key to sign their certificates that are issued to websites. Exposing this private key allows anyone to make a copy of the certificate and apply it to an illegitimate site, allowing so-called man-in-the-middle attacks, where a user’s traffic is intercepted and redirected to a malicious source. This possibility became open as soon as eight of eMudhra’s intermediate CA certificates were exposed.

A private key is part of a cryptographic pair in secure communications, with a public key being used in combination with it to create a message that disallows interception. This is done through mathematical one-way functions that make it possible for two pairs of public and private keys to be used to encrypt messages, without ever being able to infer the other party’s private keys. Variations of this technology are used everywhere from issuing SSL certificates to securing WhatsApp messages.

eMudhra’s mistake was in making a private key in its SSL certificate issuance process so small — just one to three characters long, instead of hundreds — that the private key in eight of its intermediate CAs was exposed by a security researcher, and potentially anyone who spent some effort in discovering the same vulnerability.

“Upon becoming aware of the incident, eMudhra initiated its incident response procedures, took measures to contain the affected certificates, and began working closely with browser and root-store operators to safeguard users and maintain the integrity of the broader WebPKI ecosystem,” eMudhra said on its website.

One of the CAs was actively being used in production in an unnamed U.S. industry, the company said.

Yash Kadakia, founder of the Security Brigade cybersecurity firm, said that the impact of this leak, even if patched on browsers, could extend to internet-of-things (IoT) devices that are not frequently patched to address certificate compromise incidents like this. “The cleanup could be enormous, particularly for devices and software that cannot be easily updated,” Mr. Kadakia said.

Those devices that cannot be updated, may be vulnerable to these MITM attacks, which would take advantage of outdated trusted certificate stores preloaded in them, and spoof online messages that would make the devices act unpredictably.

Many government websites, including the Aadhaar issuer UIDAI and the income tax filing portal, use eMudhra certificates or other technology from the firm. The IT Ministry insisted in a statement that these are separate systems that are not a part of eMudhra’s eSign business for digitally signing documents, or the SSL certificates used in government sites.

Since the web security industry is built on trust, however, this reputational hit may hit the firm in particular very heavily, as customers and browser developers alike reassess whether eMudhra’s certificates are reliable or not.

Comments have to be in English, and in full sentences. They cannot be abusive or personal. Please abide by our community guidelines for posting your comments.

We have migrated to a new commenting platform. If you are already a registered user of The Hindu and logged in, you may continue to engage with our articles. If you do not have an account please register and login to post comments. Users can access their older comments by logging into their accounts on Vuukle.