Government launches probe into eMudhra's digital certificate security flaw

The Ministry of Communications has initiated a formal inquiry following eMudhra Digital Technologies' disclosure of a critical error in its digital certificate issuance process. The Bengaluru firm, a significant player in India's public key infrastructure ecosystem, admitted to a flaw in key generation that potentially undermined the security of websites and digital services relying on its certificates.

The vulnerability, discovered during an internal audit, raised concerns about the integrity of digital signatures and encrypted communications that depend on eMudhra's certificate authority services. The error affected the creation of cryptographic keys—the foundational elements that secure online transactions and protect sensitive data transmitted across the internet.

Authorities and cybersecurity experts have stated that major web browsers included safeguards that would likely detect any unauthorized use of the compromised keys. These protective mechanisms were designed to alert users and prevent access to affected websites, mitigating potential damage from any attempted exploitation.

EMudhra has not reported evidence of actual misuse of the flawed keys, and investigations are ongoing to determine the full scope of the incident and whether any breach of security occurred. The company said it has taken corrective measures and is cooperating fully with regulatory authorities.

The incident has renewed focus on the need for robust oversight and quality assurance standards among India's digital infrastructure providers, particularly those handling security-critical functions. Regulators are examining whether additional safeguards or certification requirements should be implemented across the sector.