India’s cybersecurity agency CERT-In has issued an advisory following the discovery of a security flaw involving eight intermediate digital certificate authorities linked to Indian cybersecurity company eMudhra. The weakness could have allowed attackers to create fraudulent certificates and impersonate legitimate websites, raising concerns about the security of online communications.

In its advisory dated October 21, CERT-In said the affected cryptographic private keys had been generated with insufficient randomness, making them vulnerable to recovery. Digital certificates help browsers verify website identities and establish encrypted connections, protecting information exchanged online.

"eMudhra Limited, an India-based Certification Authority (CA), has reported a compromise of private keys associated with eight intermediate CA certificates in its public key infrastructure (PKI), comprising six TLS certificates and two code-signing certificates," the CERT-In note said.

The incident highlights the importance of cybersecurity awareness among students, teachers and educational institutions, which increasingly rely on digital platforms for learning, examinations, payments and communication.

What should users do?

CERT-In has recommended that users and organisations install the latest security updates for browsers, applications and operating systems. IT administrators should check whether their systems depend on affected certificates, update certificate trust information and replace certificates where necessary.

Users should also pay attention to browser security warnings rather than bypassing certificate-validation errors. Educational institutions managing websites, student portals and online services should review their certificate dependencies and ensure that security updates are applied promptly.

The incident does not, by itself, establish that users’ personal information has been stolen. In a statement on October 21, eMudhra said the affected intermediate authorities had not issued certificates to individual websites or end users. The company also said its Indian digital signature certificate and eSign services were unaffected because they operate on separate infrastructure. The investigation into the incident is ongoing.

For students learning about cybersecurity, the episode illustrates why online trust depends on more than passwords and antivirus software. Digital certificates, secure configurations and timely software updates are also essential to protecting users and the systems they depend on.