Technology · India Bureau
Government probes major digital certificate security breach at eMudhra
India's cybersecurity authority has flagged a significant vulnerability in eMudhra's digital certificate infrastructure, citing weak cryptographic randomness that compromised private encryption keys. The security flaw potentially exposed certificate issuance systems to fraudulent exploitation.
LSN India ·
The government has established a dedicated investigative team to examine a critical security vulnerability affecting eMudhra, a major digital certificate service provider in India. The Indian Computer Emergency Response Team (CERT-In) identified that insufficient cryptographic randomness in the company's systems had weakened private key generation, creating exposure for fraudulent activity.
According to CERT-In's assessment, the compromised private keys create a pathway for unauthorized actors to generate counterfeit digital certificates. This capability could enable attackers to impersonate legitimate websites and services, potentially facilitating phishing attacks, malware distribution, or other cyber fraud schemes targeting unsuspecting users.
Digital certificates form a foundational security layer for internet commerce and secure communications across India's digital infrastructure. eMudhra's platform is widely used for e-governance, banking, and commercial transactions, making the scope of this vulnerability significant for both government operations and private sector security.
The special investigative team is tasked with determining the extent of the breach, identifying affected certificates, and implementing corrective measures. Authorities are expected to issue guidance to organizations relying on eMudhra's services regarding certificate validation and revocation procedures.