What does eMudhra’s web security key leak mean for internet users? | Explained

The exposure of eMudhra’s private keys could allow for man-in-the-middle attacks if left unpatched on all devices

Updated - October 23, 2026 07:41 am IST

A private key is part of a cryptographic pair in secure communications, with a public key being used in combination with it to create a message that disallows interception. | Photo Credit: Getty Images/istockphoto

The story so far: Eight private keys used to issue web security certificates by Bengaluru-headquartered eMudhra Ltd were exposed, it emerged on Tuesday (October 20, 2026). The incident has prompted an advisory by the Computer Emergency Response Team, India (CERT-in) and immediate patches from developers of major web browsers. eMudhra’s services are used across several government and public sector bank websites.

The internet relies on a small number of so-called “root” certifying authorities (CAs) who can then authorise intermediate CAs to issue SSL certificates for webpages. Those SSL certificates are on practically every website, acting as an assurance that a website is what it claims to represent. This system works on trust, and only a handful of root CAs are trusted by browsers around the world. eMudhra operates one of these trusted CAs.

Published - October 22, 2026 09:56 am IST

technology (general) / computing and information technology / crime / crime, law and justice / The Hindu Explains / cyber crime / cybersecurity

Terms & conditions | Institutional Subscriber

Comments have to be in English, and in full sentences. They cannot be abusive or personal. Please abide by our community guidelines for posting your comments.

We have migrated to a new commenting platform. If you are already a registered user of The Hindu and logged in, you may continue to engage with our articles. If you do not have an account please register and login to post comments. Users can access their older comments by logging into their accounts on Vuukle.