eMudhra Limited:
The Ministry of Electronics and Information Technology (MeitY) recently formed a special team to investigate the leak of private keys associated with web security certificates issued by Bengaluru-based eMudhra.
- eMudhra Limited is an Indian digital trust company that provides digital certificates and services for verifying identities and securing online transactions.
- It operates as a certificate authority (CA), an organisation that issues digital certificates to help websites and other entities prove their identity online.
- A digital certificate works much like an identity card for a website.
- When someone visits a banking website, for example, the browser checks its certificate to help establish that it is connecting to the genuine website rather than an impostor.
- CA’s issue these certificates, which browsers use to determine whether a website’s identity can be trusted.
- eMudhra also provides digital signature certificates and electronic signing services that allow people and businesses to sign documents online.
- The company is listed by the Controller of Certifying Authorities (CCA), the government body responsible for licensing and regulating certifying authorities in India.
- eMudhra is also associated with Aadhaar-linked electronic know-your-customer (e-KYC) services, according to the Unique Identification Authority of India (UIDAI).
- eMudhra is not the only company authorised to issue digital certificates in India.
- The CCA’s list includes other providers such as Protean, C-DAC, Capricorn and VSign
- Their services vary, but they operate within India’s regulated digital-signature ecosystem.
- When someone visits a website, the browser needs to check that it is connecting to the genuine website and that information exchanged with it is protected from being read or altered by others.
- This is where HTTPS (Hypertext Transfer Protocol Secure) comes in.
- It helps secure the connection between a website and a browser using a system called Transport Layer Security (TLS).
- As part of this process, the website presents a digital certificate that helps the browser verify its identity.
- The digital certificate links the website’s name to a public key, while the website keeps a matching private key secret.
- The browser checks the certificate to see whether it was issued by an authority it trusts and whether it is valid.
- If these checks succeed, the browser can establish an encrypted connection.
- This helps protect information such as passwords, payment details and private messages as they travel across the internet.
- However, a secure connection does not guarantee that a website is legitimate or that its content is safe.
- It helps confirm the website’s identity and protects information exchanged with it, but a fraudulent website can also have a valid security certificate.
