India’s cybersecurity agency CERT-In has warned of a security issue affecting eight digital certificates linked to eMudhra Limited, raising concerns about the safety of online connections.
In an advisory issued on Wednesday, the agency said the issue affected eMudhra’s international website security system. Weaknesses in how some digital keys were created could allow attackers to make fake certificates and pretend to be trusted websites.
However, CERT-In clarified that India’s domestic Digital Signature Certificate and eSign systems were not affected.
The agency said eMudhra revoked all eight affected certificates on October 18, 2026. Mozilla and Google also took steps to block the affected certificates and protect users.
According to the advisory, eMudhra reported that the affected certificates had not been used to issue certificates for individual websites. Google also said it found no related website certificates in public records before blocking them.
No confirmed misuse of the compromised keys had been reported in the available public disclosures as of October 21.
CERT-In has advised organisations and users to update their browsers, applications and system security settings. The Ministry of Electronics and Information Technology has also formed a team to investigate the incident.
