New Delhi [India], October 22 : The eMudhra certificate security incident highlights the need for independent technical verification, continuous trust monitoring and stronger cybersecurity safeguards, as weak digital certificate keys could potentially be misused to impersonate legitimate websites, Vineet Kumar, Founder and Global President of CyberPeace, said.
Speaking to ANI, Kumar said eight intermediate certification authority keys were found to be cryptographically weak, raising concerns about the potential misuse of digital certificates for phishing and impersonating legitimate websites on vulnerable systems.
The e-Mudhra incident involved eight digital certificate authority keys found to be cryptographically weak due to faulty key generation back in April 2025. The flaw could have allowed attackers to create fraudulent certificates, impersonate legitimate websites and facilitate phishing attacks. Browser providers moved to block the affected certificates. 
He said the incident was serious because public key infrastructure (PKI) forms the foundation of digital trust on the internet, enabling browsers to verify website identities and establish secure connections for banking, government portals and e-commerce platforms.
However, Kumar clarified that the incident did not indicate a failure of the underlying cryptographic technology.
"We must actually distinguish between a failure within PKI and a failure of PKI itself. The underlying cryptographic algorithm has not actually broken," he said, adding that the incident concerned weak key generation rather than a mathematical break of P-384 cryptography.
Kumar said no breach or compromise of e-Mudhra's infrastructure had been reported so far, while stressing that further investigation was required to establish whether any misuse had occurred.
Kumar said browser companies, including Google and Mozilla, had acted quickly to prevent affected certificates from being trusted. However, he warned that the removal of certificates could also disrupt legitimate websites and applications that had not migrated to unaffected certificates, particularly affecting small and medium enterprises.
He said organisations must replace affected certificates promptly while ensuring continuity of essential online services.
"Regulations and compliances on paper do not always translate into security in practice," Kumar said, calling for independent technical verification rather than reliance on compliance certificates alone.
He recommended regular browser and device updates, continuous certificate transparency monitoring, rapid certificate revocation, proper certificate inventories and stronger key-management safeguards. He also urged cybersecurity teams to remain vigilant against possible exploitation.
Kumar said the incident should serve as an opportunity for India to strengthen its cybersecurity standards and accountability, adding that digital trust must become more resilient, transparent and independently verified. 
CyberPeace advised users to update their browsers and devices, avoid bypassing security warnings, verify website addresses, and enable two-factor authentication to reduce phishing risk. It also warned against fraudulent messages offering to fix the e-Mudhra issue. 
For enterprises, the organisation recommended identifying and replacing affected certificates before Google's planned root certificate removal on October 27, 2026, while checking servers, applications and other systems with independent trust stores. 
The Ministry of Electronics and Information Technology (MeitY) clarified that India-specific digital signature and eSign services remained unaffected. It said that a special team was formed to investigate the incident and is coordinating with stakeholders to resolve the issue. Its cybersecurity agency, CERT-In, issued an advisory on Wednesday, warning about the compromised certificates and outlining mitigation measures.
On the National Stock Exchange, shares of eMudhra ended over 20 per cent lower at INR 345.60 and traded in red for the entire session on Thursday.