India’s prominent digital security company, eMudhra, has suffered a leak of eight private keys, raising serious cybersecurity concerns. These private keys are critical for creating SSL/TLS certificates that secure websites. Notably, several important Indian government websites, including those run by UIDAI (the agency issuing Aadhaar) and the Income Tax Department, use eMudhra’s certificates and technologies. This incident has prompted a government advisory to warn users and stakeholders.
Security Lapses in Key Generation
Private keys need to be extremely secure, generated as long random numbers to prevent any possibility of hacking or duplication. However, reports, including those from The Hindu, reveal that eMudhra’s eight private keys were produced with significant flaws. Instead of random 384-bit numbers, some keys had alarmingly low values, with one key as small as 4 and another just 56, exposing a severe vulnerability in their security protocols.
This level of negligence in creating private keys is unusual and dangerous, as it weakens the cryptographic strength required to protect internet communications. The weak keys could be guessed or exploited to impersonate legitimate websites, leading to potential data breaches.
Potential Risks to Government Websites
If hackers gained access to these leaked keys, they could create counterfeit websites that appear authentic. This is particularly worrisome because many government portals trusted by millions, including UIDAI and Income Tax filing websites, depend on eMudhra’s certificates. Fake government sites could trick users into sharing sensitive personal information, resulting in identity theft and data loss.
The risks extend beyond individual users to national cybersecurity, as compromised certificates undermine trust in official online services. Users might unknowingly enter confidential details on cloned websites, leading to widespread damage.
CERT-In’s Response and Recommendations
India’s Computer Emergency Response Team (CERT-In) has issued advisories following this revelation. They urged users to immediately update software such as Firefox, Chrome, and operating systems to their latest security patches. CERT-In also stressed the importance of not ignoring browser or system warnings related to website certificates, as bypassing these alerts can expose users to security threats.
International tech companies acted swiftly in response. Mozilla released an update that blocked the compromised keys, while Google blocked them in Chrome. Furthermore, Google announced it will stop trusting eMudhra’s emSign Root CA security system starting October 27, 2026, to minimize future risks.
eMudhra’s Statement
The company clarified that the leaked private keys were never issued as certificates to any person or website, emphasizing that their primary Root CA system remains secure. They maintain that the main infrastructure was not compromised and reassured users of ongoing security.
The incident serves as a reminder of the critical importance of rigorous cryptographic standards for digital security providers, especially those serving government clients. It underlines the need for continuous oversight and swift action to safeguard sensitive online interactions.
