As AI tools and agents are making it easier to find security gaps and carry out cyberattacks, keeping the internet safe has become more important than ever. Now, a security issue related to Indian digital trust and cybersecurity company has raised fresh concerns about how much we can trust the websites we visit every day.
Apple, Google, Microsoft and Mozilla have blocked certain security certificates linked to eMudhra after researchers found that their private keys were so weak that they could be recovered almost instantly.
But what exactly went wrong, and why should every Indian internet user know about it?
What Is The eMudhra Security Issue?
eMudhra provides digital signature and cybersecurity services and also operates as a Certificate Authority, which means it issues digital certificates that help browsers verify the identity of websites.
The issue involves eight intermediate security certificates whose private keys were found to be compromised. These certificates were created in April 2025, but a flaw in the key generation process made the keys much weaker than they should have been.
A security researcher discovered the problem and reported it to major browser companies. Google and Mozilla confirmed the issue and blocked the affected certificates. Apple and Microsoft also took action to stop their software from trusting the affected certificates.
Why Is This A Serious Security Problem?
To understand the problem, imagine a website’s security certificate as an identity card. When you visit a banking website or make an online payment, your browser checks the website’s certificate to help confirm its identity and establish an encrypted connection.
Now imagine someone getting access to the system that issues these identity cards. If the person can create fake certificates that browsers trust, they can impersonate legitimate websites and put users’ online communications at risk.
That is the concern in the eMudhra case. The compromised private keys have allowed attackers to create fake certificates for websites they did not own.
The issue is particularly serious because internet security depends on a chain of trust between certificate authorities, browsers and website operators. A weakness in one part of this system can create risks for services that depend on it.
Why Should Every Indian Care?
India is highly dependent on digital services, including online banking, shopping, payments and government services. People need to be confident that the websites they use are genuine and that their information is protected.
The eMudhra incident is a reminder that this trust depends on more than strong passwords or antivirus software. It also relies on the security systems working behind the scenes.
For users, the best step is to keep browsers and devices updated, pay attention to security warnings and avoid entering sensitive information on suspicious websites.
There is no need to panic, but ignoring such incidents would also be a mistake.
Google said it found no website certificates issued by the six affected website-security intermediates in public Certificate Transparency records before the blocking action. eMudhra has also said that the affected intermediate certificates had not issued certificates to end users.
