New Delhi, Oct 21 The Ministry of Electronics and Information Technology (MeitY) on Wednesday said it has constituted a special team to investigate a security incident at eMudhra, whose digital certificates help browsers confirm that a website is genuine.
The reported security incident largely pertains to global certificate biz, and the impact on Indian sites and applications are “very limited”, it said in a statement.
The statement from the government assumes significance as Indian digital certification authority eMudhra has revealed that private keys associated with its certificates have been compromised, which verify trusted digital assets and ensure secure online data transmission. The shocking disclosure came after an advisory from the cybersecurity watchdog CERT-In.
In the statement, the IT ministry also called out some social media accounts that it said were “indulging in fear-mongering about the impact of this incident”.
Laying out the “facts of the case”, the IT ministry said eMudhra operates in two distinct areas. The first is the issuance of Digital Signature Certificates and eSign services, which are regulated by the Controller of Certifying Authorities (CCA) under MeitY.
The second is the issuance of digital certificates trusted by major browsers and operating systems, used to secure websites, software and online communications.
The second function is international in nature and operates under a global trust framework, the ministry said. It is governed by international standards and subject to independent audits, including WebTrust audits conducted by BDO International Limited.
The ministry said the reported incident pertains only to this global function, and that MeitY is not involved in its audit.
“The impact of this incident on Indian websites and applications has been very limited and for a very short interval,” the ministry said.
It stressed that Digital Signature Certificates and eSign services regulated by the CCA remain completely unaffected.
(PTI News)
