The story so far: Eight private keys used to issue web security certificates by Bengaluru-headquartered eMudhra Ltd were exposed, it emerged on Tuesday (October 20, 2026). The incident has prompted an advisory by the Computer Emergency Response Team, India (CERT-in) and immediate patches from developers of major web browsers. eMudhra’s services are used across several government and public sector bank websites.

The internet relies on a small number of so-called “root” certifying authorities (CAs) who can then authorise intermediate CAs to issue SSL certificates for webpages. Those SSL certificates are on practically every website, acting as an assurance that a website is what it claims to represent. This system works on trust, and only a handful of root CAs are trusted by browsers around the world. eMudhra operates one of these trusted CAs.