A private key is part of a cryptographic pair in secure communications, with a public key being used in combination with it to create a message that disallows interception.
| Photo Credit: Getty Images/istockphoto
The story so far: Eight private keys used to issue web security certificates by Bengaluru-headquartered eMudhra Ltd were exposed, it emerged on Tuesday (October 20, 2026). The incident has prompted an advisory by the Computer Emergency Response Team, India (CERT-in) and immediate patches from developers of major web browsers. eMudhra’s services are used across several government and public sector bank websites.
The internet relies on a small number of so-called “root” certifying authorities (CAs) who can then authorise intermediate CAs to issue SSL certificates for webpages. Those SSL certificates are on practically every website, acting as an assurance that a website is what it claims to represent. This system works on trust, and only a handful of root CAs are trusted by browsers around the world. eMudhra operates one of these trusted CAs.
Published – October 22, 2026 09:56 am IST
