Former CERT-In chief Gulshan Rai wants an audit and licence suspension for eMudhra after a security lapse. "Given what we have seen with eMudhra's global business, they must be audited and scrutinised for their Indian operations," Rai said. The company recently exited its global digital certificate business following the incident.
Former CERT-In chief Gulshan Rai calls for an audit of eMudhra's India operations and licence suspension after a global SSL/TLS certificate security lapse involving eight intermediate certificate authorities.
Former CERT-In director-general and India's first National Cyber Security Coordinator Gulshan Rai has called for an audit of eMudhra's Indian operations following a security lapse involving the company's global digital certificate business. He has also called for the company's licence to be suspended until the audit is completed.
Rai said eMudhra's domestic operations needed to be scrutinised given the company's close involvement with key digital services, including Aadhaar, income tax filing, Goods and Services Tax (GST) filing and Registrar of Companies (ROC) filings.
"Given what we have seen with eMudhra's global business, they must be audited and scrutinised for their Indian operations," Rai said. He added that the company's licence should be suspended until the audit is completed.
His remarks come after India's cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), issued an advisory on October 21 regarding a security compromise involving eight intermediate digital certificate authorities linked to eMudhra.
What happened in the eMudhra security incident?
According to CERT-In, private cryptographic keys associated with the eight intermediate certificate authorities had been generated with insufficient randomness, making them vulnerable to recovery.
The compromised keys could potentially allow attackers to create fraudulent website security certificates, impersonate legitimate websites and interfere with encrypted internet communications.
The issue came to light on October 17, when a security researcher reported that the affected certificates had private keys with an extremely small effective key space, making them vulnerable to being guessed almost instantly.
Following the discovery, major browser providers, including Google, Mozilla and Apple, moved to block or distrust the affected certificates. These measures were intended to prevent browsers from trusting potentially fraudulent certificates issued using the compromised keys.
CERT-In advised organisations and users to update affected software, check certificate dependencies, update certificate trust stores and replace affected certificates where necessary. It also cautioned against bypassing certificate-validation warnings.
eMudhra exits global SSL/TLS certificate business
On October 22, eMudhra announced that its board had decided to exit the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business following the incident.
The company said the business contributed around 1% of its global revenue. It cited rising data sovereignty and compliance requirements, along with the availability of free SSL/TLS certificates, as factors behind the decision.
eMudhra said it had revoked the affected intermediate certificate authorities within 14 hours of discovering the issue. Chairman V Srinivasan said no end-entity certificates had been issued through the affected authorities, the company's infrastructure had not been breached and no data had been lost.
The company also said it would arrange replacement certificates for affected customers at no cost through partners.
Its other services, including digital signature certificates, eSign, enterprise public key infrastructure products, electronic signing solutions and identity and authentication products, would continue to operate.
Why are eMudhra's Indian operations under scrutiny?
eMudhra provides digital identity, authentication, electronic signature and digital certificate services. Its digital signature certificates are used by individuals and businesses for activities such as filing GST returns, submitting documents to government portals and signing documents electronically.
The company's services form part of the wider digital trust ecosystem, in which certificates help establish identities and secure online transactions.