eMudhra Ltd, a Bengaluru-based company, is facing scrutiny after the exposure of its private keys used for issuing web security certificates. The breach, revealed on October 20, 2026, has led to immediate action from the Computer Emergency Response Team, India (CERT-in), and prompted updates from major web browser developers.
The incident has raised concerns about potential man-in-the-middle (MITM) attacks. Such attacks could occur if the exposed keys are used to create fraudulent certificates, allowing malicious actors to intercept and redirect user traffic. This vulnerability was identified when eight of eMudhra's intermediate CA certificates were compromised.
In the realm of secure communications, a private key is paired with a public key to encrypt messages, ensuring they cannot be intercepted. This technology underpins SSL certificates, which authenticate websites. eMudhra, as a trusted certifying authority (CA), plays a crucial role in this system. However, the exposure of its private keys threatens the integrity of this trust-based framework.
The breach was discovered by a security researcher, highlighting a significant vulnerability in eMudhra's SSL certificate issuance process.
Upon learning of the breach, eMudhra initiated its incident response protocols. The company is collaborating with browser and root-store operators to mitigate the impact and protect users. One of the compromised CAs was reportedly in use within an unnamed U. S. industry.
Yash Kadakia, founder of Security Brigade, emphasized the potential widespread impact of this leak. He noted that while browser patches can address the issue, many internet-of-things (IoT) devices may remain vulnerable due to infrequent updates. These devices, relying on outdated certificate stores, could be susceptible to MITM attacks, leading to unpredictable behavior.
eMudhra's certificates are utilized by numerous government websites, including the Aadhaar issuer UIDAI and the income tax filing portal. The IT Ministry has clarified that these systems are distinct from eMudhra's eSign business and the SSL certificates used on government sites. Nonetheless, the incident poses a reputational risk to eMudhra, as trust is paramount in the web security industry.
The breach underscores the critical nature of maintaining robust security measures in the issuance of SSL certificates. As the internet's infrastructure relies heavily on a few trusted CAs, any compromise can have far-reaching implications. eMudhra's swift response and ongoing collaboration with industry stakeholders aim to restore confidence and ensure the continued integrity of the WebPKI ecosystem.
