NEW DELHI — India's Computer Emergency Response Team ordered the revocation and reissuance of digital certificates issued by Bengaluru-based eMudhra on Saturday, after researchers found a flaw in the keys underpinning eight of its certificate authorities.

The defect, disclosed earlier this week, affected the way eMudhra generated cryptographic keys used to secure websites, government portals and signed documents. Security researchers warned that weak key generation could, in theory, allow attackers to impersonate trusted sites or forge digital signatures used across India's e-governance systems.

eMudhra is one of India's largest licensed certifying authorities under the Controller of Certifying Authorities, issuing certificates for tax filings, corporate signatures and secure web traffic. An eMudhra spokesperson said the company had begun revoking and reissuing affected certificates and was cooperating with CERT-In and the Controller of Certifying Authorities.

Mozilla and Google, which maintain the root trust stores used by Firefox and Chrome, have historically removed or restricted authorities implicated in key-generation failures. Engineers involved in the CA/Browser Forum said affected eMudhra roots faced distrust timelines unless rapid remediation was verified. This would break affected certificates in major browsers.

The incident renewed scrutiny of India's public key infrastructure, which underpins the Aadhaar-linked and corporate signing ecosystems. The Controller of Certifying Authorities is reviewing eMudhra's audit records and remediation plan to determine whether further enforcement action is warranted.