New Delhi

TheMinistry of Electronics and Information Technology (MeitY) has launched an investigation into a security incident involving eMudhra, while the Indian Computer Emergency Response Team (CERT-In) has issued an advisory outlining mitigation measures.

The impact on Indian websites and applications was limited and temporary, government sources said cited by NDTV Profit, adding that eMudhra's India-regulated Digital Signature Certificate (DSC) and eSign services were not affected. Officials also cautioned against exaggerated claims circulating on social media and said more details would be shared after the investigation is completed.

"We are taking it up with them, and we are also taking it up with other operators to check whether they have further issues," as per the report.

According to eMudhra, the issue relates to a small segment of its international Transport Layer Security (TLS) certificate business and does not involve its domestic digital signature operations.

The company stated that a flaw in its system resulted in the creation of weak cryptographic keys alongside the intended strong keys.

The issue came to light after a researcher alerted major technology firms, including Apple, Google, Microsoft and Mozilla, that the weak keys could potentially be reverse-engineered, including through AI-assisted techniques.

In its advisory, CERT-In said eMudhra had reported the compromise of private keys associated with eight intermediate certification authority certificates within its public key infrastructure (PKI), including six TLS certificates and two code-signing certificates.

TLS certificates are used to secure communications between websites, browsers and applications.

Security experts warn that misuse of compromised keys could enable attackers to issue fraudulent certificates for domains they do not control, impersonate legitimate websites and potentially intercept or alter encrypted communications. Similarly, compromised code-signing certificates could be misused to distribute software appearing to come from trusted sources.

eMudhra maintained that its infrastructure had not been breached and that no customer data had been compromised.