The Ministry of Electronics and Information Technology (MeitY) on Wednesday said it had constituted a special team to investigate a security incident at eMudhra, a digital certification authority whose certificates help browsers verify the authenticity of websites, reported PTI.
The ministry said the incident primarily affected eMudhra’s global certificate business, adding that the impact on Indian websites and applications was “very limited”.
The statement comes after eMudhra disclosed that private keys associated with its digital certificates had been compromised. These certificates help establish trust in digital assets and secure online data transmission. The disclosure followed an advisory issued by cybersecurity watchdog CERT-In.
The ministry also criticised some social media accounts for what it described as “fear-mongering” over the potential impact of the incident.
According to the PTI report, laying out the "facts of the case", the IT ministry said eMudhra operates in two distinct areas. The first is the issuance of Digital Signature Certificates and eSign services, which are regulated by the Controller of Certifying Authorities (CCA) under MeitY.
The second is the issuance of digital certificates trusted by major browsers and operating systems, used to secure websites, software and online communications.
The second function is international in nature and operates under a global trust framework, the ministry said. It is governed by international standards and subject to independent audits, including WebTrust audits conducted by BDO International Limited.
The ministry said the reported incident pertains only to this global function, and that MeitY is not involved in its audit.
"The impact of this incident on Indian websites and applications has been very limited and for a very short interval," the ministry said.
It stressed that Digital Signature Certificates and eSign services regulated by the CCA remain completely unaffected.
The Indian Computer Emergency Response Team (CERT-In) has issued an advisory on the incident, including mitigation measures. MeitY said it remains engaged with all stakeholders to resolve the matter at the earliest, and that further details will be shared once the investigation is complete.
eMudhra issues certificates for digital signatures that are used for several online transactions by all kinds of business entities. PKI consists of several components, including public and private keys, for digital assets in mathematical codes used for encryption, digital certificates issued to websites as a mark of trust, etc.
TLS (Transport Layer Security) certificates, popularly associated with HTTPS websites, are a set of security protocols that ensure data transmission among digital assets, like browsers and apps, in a secure manner.
eMudhra, in a statement, also clarified that the incident has no connection with eMudhra's Indian Digital Signature Certificate (DSC) and eSign businesses but affected a small part of global TLS business.
"eMudhra Limited, an India-based Certification Authority (CA), has reported a compromise of private keys associated with eight intermediate CA certificates in its public key infrastructure (PKI), comprising six TLS certificates and two code-signing certificates," the CERT-In note said.
The disclosure led to fear that the compromised keys can be used by cyber criminals to develop a fraudulent online platform impersonating any genuine payment entity and lure people to make payments.
eMudhra said that its infrastructure was not compromised, no data was breached, and all physical and logical security controls of the firm remained intact.
"The affected global TLS business is a very small part of eMudhra's operations and accounts for around 1 per cent of the company's revenue. However, this may have some reputational risks for eMudhra, which cannot be quantified.
"eMudhra is working directly with customers who may be affected to give them replacement certificates, so that critical services are not disrupted. The company is also working with the root programmes and continues its root-cause investigation," eMudhra said.
eMudhra said a flaw in its system led to the creation of a set of weak keys alongside the original strong keys. A researcher had reported to Apple, Google, Microsoft and Mozilla that the weak keys could be reverse-engineered possibly with AI-assisted techniques.
CERT-In said Google has blocked the public keys of the affected TLS intermediates in Chrome through a Certificate Revocation List Set (CRLSet) update. Mozilla blocked the six affected TLS intermediate certificates of eMudhra.
(With inputs from PTI)
