What does eMudhra’s web security key leak mean for internet users? | Explained
Eight exposed private keys from eMudhra raise MITM risks across websites, prompting CERT-In advisories and urgent browser patches.
The exposure of eMudhra’s private keys could allow for man-in-the-middle attacks if left unpatched on all devices
Updated - October 23, 2026 07:41 am IST
A private key is part of a cryptographic pair in secure communications, with a public key being used in combination with it to create a message that disallows interception. | Photo Credit: Getty Images/istockphoto
The story so far: Eight private keys used to issue web security certificates by Bengaluru-headquartered eMudhra Ltd were exposed, it emerged on Tuesday (October 20, 2026). The incident has prompted an advisory by the Computer Emergency Response Team, India (CERT-in) and immediate patches from developers of major web browsers. eMudhra’s services are used across several government and public sector bank websites.
The internet relies on a small number of so-called “root” certifying authorities (CAs) who can then authorise intermediate CAs to issue SSL certificates for webpages. Those SSL certificates are on practically every website, acting as an assurance that a website is what it claims to represent. This system works on trust, and only a handful of root CAs are trusted by browsers around the world. eMudhra operates one of these trusted CAs.
Published - October 22, 2026 09:56 am IST
technology (general) / computing and information technology / crime / crime, law and justice / The Hindu Explains / cyber crime / cybersecurity
Terms & conditions | Institutional Subscriber
Comments have to be in English, and in full sentences. They cannot be abusive or personal. Please abide by our community guidelines for posting your comments.
We have migrated to a new commenting platform. If you are already a registered user of The Hindu and logged in, you may continue to engage with our articles. If you do not have an account please register and login to post comments. Users can access their older comments by logging into their accounts on Vuukle.
