The eMudhra Certificate Incident and the Web Trust System

Publication date: 22 October 2026

Introduction

On 17 October, Mozilla was informed that the private keys of eight intermediate certificates linked to eMudhra, the Bengaluru-based digital trust company, had been compromised; the same day Mozilla blocked the affected certificates in Firefox through OneCRL. According to eMudhra, the incident is confined to intermediate CAs linked to a key generation ceremony (KGC) of April 2025; the root CA keys are safe and none of the affected intermediates issued any end-entity certificate (confirmed from crt.sh records). According to press reports, MeitY has also set up a special team to investigate the matter (as quoted in the press).

Key Concepts (Stable)

• Certificate Authority (CA): an organisation that issues digital certificates certifying the identity of websites/software; in India the CCA (Controller of Certifying Authorities) licenses and regulates them.
• PKI chain: root CA → intermediate CA → end-entity certificate; the browser checks this very chain before an HTTPS connection.
• TLS/SSL certificate: for encryption of web traffic and website identity.

Context and Detailed Explanation

To understand this incident it is necessary to know the structure of the PKI chain. While connecting to a website over HTTPS, the browser checks the end-entity certificate up through the intermediate CA that issued it and then the root CA. If an intermediate's private key is compromised, the trustworthiness of all certificates issued from it comes under threat - this is why browser makers such as Mozilla block the affected certificates through an update mechanism (here OneCRL). The relief in this case is that certificate-transparency logs such as crt.sh confirmed that no end-entity certificate was issued from the affected intermediates, meaning the risk of direct misuse on the public web remained limited. In the Indian context this incident also highlights the regulatory role of the CCA (Controller of Certifying Authorities) - the licensing and inspection of certificate issuers in India falls within its jurisdiction. Processes such as the KGC (key generation ceremony) are therefore carried out under strict security procedures, because a weakness at that very stage can affect the whole chain of trust.

Exam Usefulness

Cyber security, PKI, IT governance.

Prelims Style: Practice Questions

Sources

• eMudhra official statement (20 October 2026): https://emudhra.com/en/post/certificate-security-incident
• Mozilla Bugzilla (bug 2083449): https://bugzilla.mozilla.org/show_bug.cgi?id=2083449