eMudhra Certificate Breach: Cryptographic Flaws and Global

The Indian Express · 21 October 2026 · GS 3: Internal Security · 11 min read

Why in the News?

On October 21, 2026, eMudhra revealed weak cryptographic keys linked to eight intermediate certificates. This incident risks global web security and raises questions on cryptographic monitoring.

Key Highlights

• eMudhra disclosed weak cryptographic keys on October 21, 2026.

• CERT-In warned of risks like impersonation and MitM attacks.

• Google removed eMudhra's root certificate from Chrome's Root Store.

• Affected keys were generated on April 30, 2025 with flaws.

• MeitY stated Indian DSC services were unaffected by the breach.

• The global TLS business accounts for 1% of eMudhra's revenue.

Know the Basics

• Certificate Authority (CA): An entity that issues digital certificates to authenticate websites and secure connections.

• Intermediate certificate: A certificate issued by a root CA that authorises website certificates in the trust chain.

• Man-in-the-middle (MitM) attack: An attack where a third party intercepts or alters encrypted communications between two entities.

• WebTrust audit: Independent audits that assess compliance with global trust frameworks for Certificate Authorities.

Detailed Analysis

Cryptographic flaws in eMudhra certificates

• Weak private keys linked to eight intermediate certificates were compromised, some as small as 3-8 bits, making them instantly guessable.

• The flaw originated during key generation on April 30, 2025, producing weak keys alongside strong ones.

CERT-In advisory and risks

• CERT-In warned that attackers could issue fraudulent certificates, impersonate websites or conduct MitM attacks.

• Compromised code-signing keys could enable issuance of fraudulent software certificates.

Impact on global trust chain

• Google removed eMudhra's root certificate from Chrome's Root Store, disrupting websites relying on it.

• Legacy devices unable to update may continue trusting compromised certificates, increasing systemic risks.

MeitY and Indian services unaffected

• MeitY stated Indian DSC services were unaffected as they operate on separate infrastructure from the global TLS business.

• The global TLS business accounts for only 1% of eMudhra's revenue but faces reputational risks.

Preventive measures for users and operators

• Users should update devices and browsers, avoid public Wi-Fi for banking, and heed browser security warnings.

• Website operators must verify their certificates' origin and seek replacements if linked to eMudhra.

Significance for India & UPSC Exam

• Exposes vulnerabilities in the global internet trust chain, affecting web security worldwide.

• Highlights the importance of robust cryptographic standards and monitoring for Certificate Authorities.

• Raises concerns about legacy devices unable to update, posing long-term risks.

• UPSC could test this in GS 3 under cybersecurity or as a Prelims question on Certificate Authorities.

Challenges and Way Forward

Challenges

• Legacy devices unable to update may continue trusting compromised certificates.

• Effectiveness of mandatory cybersecurity audits and cryptographic monitoring is questioned.

• Reputational damage to eMudhra's global TLS business could impact its market position.

Way Forward

• CERT-In must ensure timely replacement of compromised certificates and monitor potential misuse.

• MeitY should review cryptographic standards and audit mechanisms for Indian CAs.

• Browser companies must enhance detection of weak cryptographic keys and improve user alerts.

UPSC Prelims Practice Question

Consider the following statements about eMudhra's certificate breach:

1. The weak keys were generated on April 30, 2025.

2. CERT-In stated that the affected intermediate certificates had issued real website certificates.

3. Google removed eMudhra's root certificate from Chrome's Root Store.

Which of the statements given above is/are correct?

1. 1 only

2. 1 and 3 only

3. 2 and 3 only

4. 1, 2 and 3

Answer: (b) 1 and 3 only

Explanation: Statement 1 is correct: The keys were generated on April 30, 2025. Statement 2 is incorrect: CERT-In stated no real website certificates were issued. Statement 3 is correct: Google removed the root certificate.

UPSC Mains Practice Question

Critically analyse the implications of the eMudhra certificate breach on global web security and India's cybersecurity framework. (GS 3, 15 marks, 250 words)

Answer framework

• Start with the disclosure of weak cryptographic keys by eMudhra on October 21, 2026.

• Explain risks like impersonation, MitM attacks and systemic vulnerabilities in the global trust chain.

• Discuss CERT-In's advisory and MeitY's statement on limited impact on Indian services.

• Highlight the removal of eMudhra's root certificate by Google and its implications for websites and legacy devices.

• Evaluate the effectiveness of WebTrust audits and cryptographic monitoring in preventing such incidents.

• Conclude by recommending stronger cryptographic standards, regular audits and user awareness campaigns.

Question to Ponder

Should India mandate stricter cryptographic audits for Certificate Authorities like eMudhra?

Previous Year Questions (PYQs)

Prelims

• The terms 'WannaCry, Petya and EternalBlue' sometimes mentioned in the news recently are related to. (2018)

• In India, the term "Public Key Infrastructure" is used in the context of (2020)

• In India, it is legally mandatory for which of the following to report on cyber security incidents? (2017)

Mains

• Discuss the potential threats of cyber attack and the security framework to prevent it. (150 words) (2017, Paper III)

• Cyber warfare is considered by some defense analysts to be a larger threat than even Al Qaeda or terrorism. What do you understand by Cyber warfare? Outline the cyber threats which India is vulnerable to and bring out the state of the country's preparedness to deal with the same. [200 words] (2013, Paper III)

• What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy. (2022, Paper III)

Frequently Asked Questions (FAQs)

What is eMudhra?

eMudhra is a Bengaluru-based Certificate Authority that issues digital certificates for authenticating websites and securing online communications.

Why did Google remove eMudhra's root certificate?

Google removed eMudhra's root certificate due to weak cryptographic keys linked to eight intermediate certificates, which posed risks to web security.

What are the risks of weak cryptographic keys?

Weak cryptographic keys can enable website impersonation, man-in-the-middle attacks, interception of encrypted traffic and issuance of fraudulent certificates.