If you sign GST returns, income-tax returns, tax audit reports or MCA forms with an eMudhra digital signature certificate (DSC), the eMudhra incident does not affect your DSC. CERT-In and MeitY have both said so, and eMudhra says the same in its stock exchange filing. CERT-In's advisory CIAD-2026-0050 of 21 October 2026 states that the issue of digital signature certificates and eSign services, regulated by the Controller of Certifying Authorities (CCA), is "not impacted". MeitY said the incident does not affect eMudhra's DSC and eSign services. eMudhra's own filing with the stock exchanges on 21 October says the incident "has no connection" with its Indian DSC and eSign businesses. What was compromised is something else: eight certificates in eMudhra's global website-security business, the kind of certificate that puts the padlock in a browser's address bar. You do not need to replace your DSC token, renew early, or stop filing. You should, however, be careful of anyone who calls to tell you otherwise. Here is what happened, why your DSC is on a different system, and the few things a CA firm should actually do this week. eMudhra's stock exchange filing is attached to this article.

What happened, in plain terms

eMudhra runs two separate certificate businesses, and CERT-In's advisory sets them out that way:

  • Indian digital signatures and eSign. eMudhra is a Certifying Authority licensed under the Information Technology Act, 2000 and regulated by the CCA under MeitY. This is the business that issues DSCs, usually on a USB token, for use where the GST portal, the income-tax e-filing portal and the MCA portal require or allow them, and the Aadhaar-based eSign used to sign documents online.
  • Global website (TLS) certificates. These are the certificates a website uses to prove its identity to your browser and to encrypt the connection. They are trusted because browser makers (Google, Mozilla, Apple, Microsoft) include the issuer in their lists of trusted roots. This hierarchy is governed by the browser makers' requirements and international audits, and is not part of the CCA's Indian DSC chain of trust.

The incident is entirely in the second business. In a key generation ceremony on 30 April 2025, eMudhra created eight "intermediate" certificate authorities under its root called emSign ECC Root CA - G3. Six were for website (TLS) certificates and two for code signing. According to eMudhra, a flaw in that ceremony "caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys", and the weak keys were the ones published to the browsers' trust lists.

How weak? CERT-In's advisory says the private keys "had values smaller than 256 and could be recovered almost instantly from their corresponding public keys". Security researcher Scott Helme, who recovered them himself, reported that one of them was the number 4. A private key is supposed to be a number so large it cannot be guessed. Anyone holding these keys could have issued fake website certificates for any domain, and with them, impersonate a website to a user whose connection they could intercept.

The timeline

  • 30 April 2025: the eight intermediates are created in the key generation ceremony.
  • 17 October 2026: an independent researcher reports the weak keys to the browser makers. Google blocks the six website-certificate intermediates in Chrome the same day, and Mozilla blocks them in Firefox. (Mozilla received the report at 20:06 UTC, which was already the early hours of 18 October in India.)
  • 18 October: eMudhra revokes all eight intermediates, according to CERT-In.
  • 19 and 20 October: Apple and Microsoft block them. Mozilla releases updated Firefox versions and removes emSign ECC Root CA - G3 from its trusted list altogether.
  • 21 October: eMudhra files a press release with BSE and NSE. CERT-In issues advisory CIAD-2026-0050. MeitY says it has formed a special team to investigate.
  • 27 October: Google's removal of emSign ECC Root CA - G3 from the Chrome Root Store is expected to reach devices.

On actual misuse: Google found no website certificates under the six TLS intermediates in the public Certificate Transparency logs before it blocked them, and eMudhra says the intermediates had not issued any certificates to customers. CERT-In's advisory says that, as of 21 October, the public disclosures "do not establish confirmed malicious exploitation" of the keys.

Why your DSC is on a different system

A DSC issued in India by a licensed Certifying Authority sits in a chain of trust that ends with the CCA, the regulator under the Information Technology Act. The GST, income-tax and MCA portals check your signature against that Indian chain. They do not check it against the browser makers' lists, and nothing in the browsers' blocking touches it.

eMudhra's filing says the global TLS business "runs on infrastructure that is completely separate from the India DSC business", and that DSC and eSign services in India "are running normally". CERT-In's advisory records eMudhra's statement that the incident does not involve its root CA private keys or any other intermediate. MeitY's statement says the incident is limited to eMudhra's global website-security business and that the impact on Indian websites and applications was "very limited and for a very short interval".

So the incident gives no reason to replace a DSC, and according to eMudhra and CERT-In, Indian DSC and eSign services were running normally as of 21 October. That covers the filings where professionals use a DSC: GST returns and refunds, income-tax returns (see our guide to e-verification methods, where DSC is one of the six), tax audit reports, and MCA forms. Aadhaar eSign is in the same position.

What a CA firm should actually do

  1. Do not replace or "re-validate" a DSC because of this incident. Neither CERT-In's advisory nor MeitY's statement nor eMudhra's filing asks DSC holders to replace or re-validate anything.
  2. Warn your clients and staff about scam calls. A security story with a familiar brand name in it is ideal material for fraud: "your eMudhra DSC has been compromised, pay to renew", "share the OTP to re-verify your token", or "install this updated DSC driver from this link". Treat unsolicited calls, links, OTP requests and renewal demands as suspicious, never share an OTP or token PIN, and verify anything through contact details you find yourself on the Certifying Authority's or portal's own website. Download token drivers and signing software only from the token maker's or the Certifying Authority's own website, never from a link sent on WhatsApp or by email. Two of the compromised keys were for code signing, which is used to vouch for software, so "it looks signed" is no comfort for software from an unknown link.
  3. Update browsers and operating systems. This is CERT-In's first recommendation. Updates carry the blocks on the compromised certificates.
  4. Never click through a certificate warning on the GST, income-tax or MCA portal, or on a bank's website. A warning is the browser doing its job.
  5. Check your own website's certificate, if your firm runs one. Open the certificate's full certification path in the browser (the padlock, then the certificate details), or simply ask your hosting provider. If it chains to emSign ECC Root CA - G3, ask your web developer or hosting provider to replace it before Chrome's root store change reaches devices on 27 October, or visitors may start seeing warnings. CERT-In's advisory specifically asks administrators to replace even otherwise legitimate certificates under that root if they will no longer be trusted. If your certificate does not chain to that root, nothing needs to be done; confirm it with your host or certificate provider.

What is still open

  • The root cause. eMudhra says it "is working to establish the root cause"; it has explained the mechanism, not why it happened.
  • The outcome of MeitY's investigation, and whether the CCA will ask licensed Certifying Authorities to re-check their own key ceremonies.
  • Further action by the browser makers. Mozilla has removed emSign ECC Root CA - G3 from its trusted list, and Google has announced its removal from the Chrome Root Store, expected to reach devices on 27 October. Whether they take any action on eMudhra's other roots is for them to decide.
  • The business impact. eMudhra's filing says the global TLS business is around 1 per cent of its revenue, but that the incident "may have some reputational risks" that "cannot be quantified".

Sources

  • CERT-In Advisory CIAD-2026-0050, "Compromise of eMudhra Intermediate CA Certificates", 21 October 2026, cert-in.org.in.
  • eMudhra Limited, press release "eMudhra Statement on distrust of select Global TLS Intermediate and one Root CA", filed with BSE and NSE on 21 October 2026 (attached).
  • eMudhra, "Statement on Recent Certificate Security Incident", emudhra.com.
  • Ministry of Electronics and Information Technology, statement on X (@GoI_MeitY), 21 October 2026.
  • Mozilla Security Blog, "Protecting Firefox users following the compromise of eMudhra intermediate certificates", 20 October 2026; Mozilla Foundation Security Advisory 2026-111.
  • Scott Helme's findings, as reported by The Register, 20 October 2026.

Status as of 22 October 2026. We will update this article if the CCA or MeitY issues any direction to DSC holders.