eMudhra certificate authority keys compromised in security breach

eMudhra, a prominent certificate authority based in India, has disclosed that eight of its cryptographic keys were generated with insufficient security measures, creating a significant vulnerability in digital authentication systems. The weakly generated keys could potentially allow threat actors to create fraudulent digital certificates and impersonate legitimate websites, compromising the security of users accessing those sites.

The compromised keys were identified as part of security audits conducted by browser manufacturers and software providers. In response to the discovery, major technology companies including Mozilla, Google, and Microsoft have initiated blocking measures to prevent certificates signed with these keys from being trusted by their respective platforms and applications.

Certificate authorities like eMudhra play a critical role in India's digital infrastructure, issuing digital certificates used for e-governance, e-commerce, and secure communications. The compromise of authentication keys raises concerns about the integrity of digital transactions and online security for Indian users and organizations that may have relied on certificates issued by the affected authority.

eMudhra has been notified of the security lapse, and the affected certificates are expected to be revoked. Organizations and individuals who obtained certificates from eMudhra during the period when these keys were in use are advised to verify the authenticity of their digital credentials and take appropriate remedial action if necessary. The incident underscores the importance of rigorous security protocols in cryptographic key generation and management.