New Delhi, October 22, 2026: The government has formed a special team to investigate a reported security incident involving eMudhra digital certificates. The issue has raised concerns after CERT-In indicated that insufficient cryptographic randomness may have compromised private keys, potentially creating a risk that fraudulent digital certificates could be issued and used to impersonate websites.
Why private keys are important
Digital certificates help systems establish trust and verify the identity of websites or other digital services. They rely on cryptographic keys, including private keys that must remain confidential. If a private key is exposed or can be derived by an attacker, the security assumptions behind the certificate may no longer hold, depending on the scope of the incident and the systems involved.
What a certificate compromise can mean
In some circumstances, a compromised key could allow an attacker to create or use certificates that appear legitimate. That may create opportunities for impersonation or other attacks against users and organisations. The actual risk depends on which keys and certificates were affected, how they were used, and what corrective measures have been taken.
It is important not to assume that every customer, website or certificate is affected. Investigators need to establish the technical scope, identify relevant certificates and determine whether revocation, replacement or other remediation is required.
What organisations should do
Organisations that use digital certificates should follow official security advisories, check whether their certificates or systems are in scope, and apply vendor or government-recommended updates. Security teams should maintain an inventory of certificates, monitor expiry and revocation status, protect private keys with appropriate controls and have a tested process for replacing compromised credentials.
Users should be cautious about unexpected security warnings and should not bypass browser certificate alerts. Organisations should communicate clearly with affected customers if a confirmed impact is identified. A rushed or unverified response can create confusion, so remediation should follow authoritative technical guidance.
Investigation and next steps
The government investigation is expected to clarify the cause, extent and implications of the reported incident. Further action may depend on technical findings and the relevant regulatory framework. Until official findings are available, organisations should treat the matter seriously while avoiding unsupported claims about the number of affected systems or any confirmed misuse.
Updated: October 22, 2026. Follow official CERT-In and government advisories for verified technical guidance.
