Excerpt from Cybersecurity Dive and The Indian Express, Published on October 21, 2026
The eMudhra certificate compromise has raised concerns over website encryption security after weaknesses were identified in intermediate digital certificates associated with the Indian digital trust service provider. Browser security measures were introduced in response, while the potential impact on affected certificate-based services remains an important consideration.
What Happened in the eMudhra Certificate Compromise?
The eMudhra certificate compromise involved eight intermediate certificate authorities. Their private keys lacked sufficient randomness when generated on April 30, 2025. Six certificates supported website security, while two supported software code signing. This weakness made the private keys vulnerable to recovery. As a result, attackers could potentially misuse the certificates. Following the discovery, major browser providers, including Google, Mozilla, Apple, and Microsoft, took steps to distrust the affected certificates. India’s Computer Emergency Response Team (CERT-In) also issued an advisory about the security risks.
However, the incident does not confirm that attackers stole customer information. Reports indicated that eMudhra’s domestic digital signature certificate and eSign services remained unaffected. The company also stated that its infrastructure had not been compromised.
Compliance Lessons from the eMudhra Certificate Compromise
The eMudhra certificate compromise highlights the need for strong cryptographic controls and regular security reviews. Organisations should restrict access to sensitive keys. They should also monitor certificate lifecycles and review security configurations regularly. Businesses must also assess risks from third-party technology providers. A security weakness at a trusted provider can affect the organisations that depend on its services. Regular risk assessments help businesses identify these weaknesses early. Documented procedures and continuous monitoring also support timely corrective action.
Independent compliance audits help organisations evaluate their information security controls. Auditors can assess whether these controls are properly designed and working effectively. Frameworks such as SOC 2 and ISO 27001 help businesses evaluate security practices and manage risks. The eMudhra certificate compromise shows why businesses need continuous oversight and effective risk management. Strong security controls and regular compliance assessments can help organisations protect digital trust.
For additional information, read the reports from Cybersecurity Dive and The Indian Express.
