The security incident at Indian certificate authority eMudhra has moved on from a company announcement to action by Apple and the government. Apple has started blocking affected certificates on its devices, CERT-In has issued an advisory, and the IT ministry is investigating. Here is what that means for ordinary users and website owners.
What went wrong
Certificate authorities issue the digital certificates that let your browser confirm a website is genuine and encrypt your connection. According to CERT-In’s advisory of 21 October, eMudhra reported that private keys linked to eight of its intermediate certificate authorities had been compromised: six used for website (TLS) certificates and two for code signing. In theory, keys like these could be misused to create fake certificates, impersonate real websites or make malicious software look trusted.
eMudhra has said the affected intermediates had not issued publicly trusted certificates to customers and that it found no evidence of a data breach.
What Apple has done
Apple began blocking 12 affected TLS certificates on 19 October and added further restrictions on 23 October. On iPhones, iPads and Macs, Safari, Mail and compatible apps now reject these certificates automatically. Mac administrators and developers who use certain command-line tools may need to take extra care until a software update covers the remaining checks.
Is your eSign or digital signature safe?
Yes, according to the IT ministry. It says the incident concerns eMudhra’s international website certificate business, which is run separately from its Indian digital signature certificate (DSC) and eSign services. Those are regulated by the Controller of Certifying Authorities and remain unaffected. Officials have also urged people not to act on misleading claims circulating on social media. The ministry is coordinating with stakeholders and expects to share more once its investigation is complete.
What you should do
If you are an ordinary user: nothing special, beyond keeping your phone, computer and browser updated, since that is how protections like Apple’s reach you. If a site suddenly shows a certificate warning, do not click through it.
If you run a website: check whether your TLS certificate was issued by eMudhra. The company announced on 22 October that it is leaving the global website certificate business and will arrange free replacements through partners, so plan the switch now. Our earlier report explains eMudhra’s exit and the replacement process, and if your site runs on PHP, also read our guide to the critical php2shell flaw.