eMudhra incident puts India’s digital trust oversight under scrutiny

The security incident involving Indian digital trust company eMudhra has raised questions about the extent of Indian regulatory oversight over globally trusted digital certificates, with legal experts calling for an independent assessment mechanism to evaluate the domestic impact of such incidents and strengthen accountability.

The experts said the incident highlights a gap between India’s regulatory framework for domestic digital signature services and the international trust infrastructure governing website security certificates. They have called for better coordination between cybersecurity authorities, sectoral regulators and independent technical experts, while cautioning that India should not seek to override security decisions taken by global browser and root-store operators.

The controversy centres on eight intermediate certificate authorities (CAs) whose private keys were found to be cryptographically weak. The affected keys were generated during a key-generation ceremony in April 2025. According to the company, a flaw in the process caused weak keys to be generated alongside the intended strong keys, and the weakness went undetected through two independent audit cycles.

Google, Apple and Mozilla took steps to block the affected certificates or distrust the associated certificate hierarchy. eMudhra has said that the affected intermediate authorities had not issued publicly trusted end-entity certificates, and no compromise of its infrastructure or customer data had been identified.

"Our digital-signature & eSign/eSignature in India, and Globally, along with all of our enterprise applications operate on separate infrastructure and were not impacted in any manner. We are already in the process of moving our impacted G3 customers and our broader non-impacted TLS customers to alternate certificates at no cost," eMudra said in a statement today. "We will publish a full root-cause analysis through the CCADB process. It will explain what went wrong, why our controls failed to detect it, and the changes we are making as a result."

"The eMudhra episode is a significant reminder that digital trust is only as strong as the safeguards underpinning its weakest link. A cryptographic failure within a single certificate authority can have consequences across jurisdictions, while the ability of global technology platforms to withdraw trust underscores their considerable influence over critical digital infrastructure," said Hardeep Sachdeva, senior partner at AZB & Partners.

“India should have independent capabilities to assess the impact when global companies revoke trust, but not a power to second-guess the security determination itself,” said Anshul Verma, partner at SKV Law Offices. “Root programs decide what their own products will trust, and a mechanism that looked like a review of that call would undermine the very trust that gives Indian certifying authorities access to global markets."

"What India does need is speed in responding to the consequences. CERT-In and MeitY should have a standing protocol to identify which government, banking and payment systems rely on an affected root certificate, coordinate timelines with the relevant root programs, commission an independent technical review, and issue trust-store guidance to critical sectors. Critical infrastructure also shouldn't depend on a single CA hierarchy, and India can put that resilience requirement in place on its own," Verma added.

“India should establish a technically independent assessment mechanism, without seeking to override security decisions by browser or root-store operators. The regulatory distinction will be relevant as the CCA supervises India’s domestic PKI and digital-signature framework, whereas globally trusted web certificates operate through international WebPKI standards and private root-store programmes,” said Rohit Jain, managing partner at Singhania & Co..

“A standing mechanism led by CERT-In, with the CCA, sectoral regulators and independent cryptographic experts, would validate the technical basis for distrust, identify affected services, coordinate remediation and publish an impact assessment,” Jain added.

Regulatory powers and accountability

CERT-In, in its October 21 advisory, clarified that eMudhra’s domestic digital signature certificate and eSign services, regulated by the CCA under MeitY, were not affected. Its global TLS certificate business operates under an international trust framework and is subject to industry standards and independent audits, including WebTrust audits. The CCA’s existing framework provides for annual external audits and half-yearly internal audits of licensed certifying authorities. The global TLS incident, however, involves a separate trust framework, administered through browser and operating-system root programmes.

"Indian authorities have stronger powers over the domestic business than over the global TLS business. On the domestic side, the Controller of Certifying Authorities has audit, investigation and licensing powers, including the power to suspend a licence, over eMudhra's licensed digital signature and eSign business. The government says that business runs on separate infrastructure and is unaffected, and the CCA can verify that position rather than simply accept it," Verma said.

"The global TLS business sits differently. It operates under the browser root programs' policies and industry baseline requirements rather than an Indian licence, which is why officials say the ministry is not involved in its audit," she added.

“The Information Technology Act, 2000 provides certain powers to Indian authorities, particularly CERT-In under Section 70B, to seek information, issue directions and coordinate responses to cybersecurity incidents. The Controller of Certifying Authorities also exercises regulatory and supervisory powers under the Act,” said Ankit Sahni, partner at Ajay Sahni Associates.

“The extent of regulatory jurisdiction, investigation and possible enforcement would depend on the nature of the incident, the applicable statutory provisions and whether any obligations under Indian law have been breached,” he added.

eMudhra had announced its exit from the global website-security certificate business following the incident. The company has also said it is arranging replacement certificates for affected customers and offering alternatives to reduce dependence on a single certificate authority hierarchy.

“The international nature of a certification framework, by itself, cannot exclude the application of Indian law. Independent audits cannot be treated as an absolute shield against liability. Any determination of responsibility must rest on the applicable legal obligations,” Sachdeva said.

“This incident should prompt a broader examination of how technical assurance, regulatory oversight and corporate accountability can work together to strengthen confidence in the global digital trust ecosystem,” Sachdeva concluded.