eMudhra issue: Government looking at domestic alternatives

SENSEX 73,249.39

 -460.30

NIFTY 22,687.65

 -123.70

CRUDEOIL 9,378.00

+ 170.00

GOLD 143,570.00

 -2,509.00

SILVER 200,328.00

 -8,840.00

SENSEX 73,249.39

 -460.30

NIFTY 22,687.65

 -123.70

NIFTY 22,687.65

 -123.70

CRUDEOIL 9,378.00

+ 170.00

CRUDEOIL 9,378.00

+ 170.00

GOLD 143,570.00

 -2,509.00

'; } document.getElementById("lgdv").innerHTML = htmlElements; } function numberformat(i) { return Number(parseFloat(i).toFixed(2)).toLocaleString('en', { minimumFractionDigits: 2 }) } async function gatherResponse(response) { const { headers } = response; const contentType = headers.get('content-type') || ''; if (contentType.includes('application/json')) { return await response.json() } return response.text(); } function getWidth() { if (Math.max(document.body.scrollWidth,document.documentElement.scrollWidth,document.body.offsetWidth,document.documentElement.offsetWidth,document.documentElement.clientWidth) > 991) { document.getElementById("mob").style.display = "none"; document.getElementById("lgdv").style.display = "block"; } else { document.getElementById("mob").style.display = "block"; document.getElementById("lgdv").style.display = "none"; } } getWidth(); THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.

Special team probes compromised keys as eMudhra exits global SSL/TLS certificate business

By S Ronendra Singh

Updated - October 22, 2026 at 09:53 PM. | New Delhi

MeitY explores Indian providers after overseas audit links complicate response to the incident | Photo Credit: hiro-hideki

The government is exploring domestic alternatives to overseas audit firms associated with the international digital certificate ecosystem following the eMudhra security incident involving Belgium-based BDO International Ltd. It is looking to strengthen its oversight of the process and reduce dependence on entities based abroad, government sources said.

The move follows the compromise of private keys associated with eight intermediate certificates operated by eMudhra, which could potentially have been used to issue fraudulent certificates and impersonate websites. eMudhra said all eight certificates were revoked on October 19 and that none had been used to issue customer certificates.

The involvement of an overseas entity had complicated the government’s response, prompting it to consider India-based providers, a senior government official said.

eMudhra on Thursday also announced that its board has decided to voluntarily withdraw from the global SSL/TLS (Secure Sockets Layer and Transport Layer Security) certificate business. SSL/TLS are cryptographic protocols that encrypt data transmitted between a web browser and a server.

“It (BDO) is an international certifying agency/ firm is Belgium-based and it was not in our system. So, it took some time to handle the situation following the alerts. We are therefore now looking at alternative companies available here,” the official told businessline. That is why alternative keys have been also created to avoid more security keys are exposed, he added.

The Ministry of Electronics and Information Technology (MeitY) has also set up a special investigating team to look into the eMudhra matter. Sources said the team is being headed by the Deputy Controller of the Controller of Certifying Authorities (CCA), with senior officials from other departments, including CERT-In, Aadhaar and the National Payments Corporation of India (NPCI), as members.

“Browsers are no longer accepting the keys, and alternatives have already been created to protect customer data. We are working tirelessly to ensure that such incidents are not repeated in the future. The team has been set up, and we are working on alternatives,” the official said.

The eMudhra matter came to light on October 17 after a researcher alerted Google and other technology companies that private keys associated with the certificates were vulnerable. eMudhra revealed that eight private keys associated with its certificates were compromised. The company said its infrastructure was not compromised and no data breach had occurred.

Many government websites, including the Aadhaar and the income tax filing portal, use eMudhra certificates or other technology from the firm.

On Wednesday, MeitY had said that it remains engaged with all the stakeholders to resolve this incident at the earliest. The Indian Computer Emergency Response Team (CERT-In) also had issued an advisory in regards to the incident including the mitigation measures.

eMudhra’s regulated Digital Signature Certificates and eSign services remain unaffected, sources earlier said.

Meanwhile, eMudhra on Thursday also announced that its board has decided to voluntarily withdraw from the global SSL/ TLS (Secure Sockets Layer and Transport Layer Security) certificate business. SSL/ TLS are cryptographic protocols that encrypt data transmitted between a web browser and a server.

V Srinivasan, Chairman, eMudhra said that global SSL/ TLS is a small part of eMudhra’s business contributing to about one per cent of the global revenue.

He said the decision was taken due to increasing data sovereignty and compliance requirements, complexity and cost associated with this business is increasing over the years.

Besides, some of the large entities issue the SSL/TLS free of cost, therefore the business potential and return on investment of this line of business also has considerably reduced for eMudhra when measured against our cumulative revenue base, he added.

Published on October 22, 2026

THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS. THIS AD SUPPORTS OUR JOURNALISM. SUBSCRIBE FOR MINIMAL ADS.Sign into Unlock benefits!

• Access 10 free stories per month
• Get notified by email for early preview to new features, discounts & offers