The Ministry of Electronics and Information Technology (MeitY) has constituted a special team to investigate a reported security incident involving eMudhra’s Public Key Infrastructure (PKI), while stating that the impact on Indian websites and applications was limited and that the company’s Digital Signature Certificate (DSC) and eSign services remain unaffected.
“MeitY has taken serious note of the reported incident. The government stressed that eMudhra operates in two distinct areas: the issuance of Digital Signature Certificates and eSign services regulated by the Controller of Certifying Authorities (CCA) under MeitY; and the issuance of digital certificates trusted by major browsers and operating systems to secure websites, software and online communications.
A special team has been constituted to investigate the matter,” the government said in a statement. Addressing concerns circulating on social media, the government added that some accounts were “indulging in fear mongering about the impact of this incident”. “The impact of this incident on Indian websites and applications [has] been very limited and for a very short interval,” it said. The government has said this is separate from the digital signatures eMudhra issues under Indian regulation for signing documents electronically, and that those are unaffected. The government said CERT-In had issued an advisory containing mitigation measures and that MeitY was coordinating with stakeholders to address the incident. “MeitY remains engaged with all the stakeholders to resolve this incident at the earliest,” the statement said. “Further details will be shared upon completion of the investigation,” it added.
