Decode Civils CAShorts
Current affairs Open app
ExplainerSci-TechGS2GS3

Digital certificates and PKI: Certifying Authorities and the CCA

By CAShorts DeskPublished Sources: CCA, MeitY; IT Act, 2000 (PRS text); Google Chrome Security; Mozilla; Cloudflare; The Indian Express

Why in news: On 17 October 2026 a researcher reported the compromise of eight eMudhra intermediate CA keys; Chrome and Firefox blocked the certificates that day.

Digital certificates and PKI: Certifying Authorities and the CCA
Illustration (AI-generated)

Under the Information Technology Act, 2000, licensed Certifying Authorities issue Digital Signature Certificates binding a person to a public key, while the Controller of Certifying Authorities licenses them and certifies their own keys through the Root Certifying Authority of India. Browser makers have blocked eight eMudhra intermediate certificates whose private keys were weakly generated.

Syllabus: GS2 · Statutory & Regulatory Bodies; GS3 · IT, Space, Biotech & IPR; GS2 · Governance & e-Governance

Why this matters for UPSC

GS3 science and technology and cyber security, with GS2 statutory bodies: Prelims can ask what the Controller of Certifying Authorities does under the IT Act, 2000 and how a key pair works; Mains, about trust in digital signatures.

In short

Public key infrastructure lets strangers trust a signature or website through certificates; under the IT Act, 2000, the CCA licenses Certifying Authorities and anchors India's chain of trust.

India's chain of trustCentral Governmentappoints the CCARCAI signs publickeysLicensed CAs issuecertificatesAnyone verifies thesignature

India's licensing framework is sound on paper; its credibility now rests on verified key generation and oversight matching its CAs' global reach.

Why it matters

Every taxpayer filing a return with a signature token, every company director signing documents online and every person typing a bank password into a website relies on a certificate vouched for by someone else. If the secret key behind one of those vouchers can be guessed, a criminal can pose as a trusted bank or government site, read what people type and change it without leaving a mark. Fixing it is costly: websites holding honest certificates from the same root must replace them, and old phones that no longer receive updates stay exposed. The larger issue is who checks the checkers, since India's own signature regulator covers only part of the trust its citizens depend on.

Prelims pointers

  • The Controller of Certifying Authorities works under the general control and directions of the Central Government, per section 17(2) of the IT Act, 2000.
  • An applicant obtains a Digital Signature Certificate from a licensed CA, which verifies identity through attested papers, Aadhaar eKYC or banking eKYC.
  • A licence to issue electronic signature certificates is neither transferable nor heritable, and its application must carry a certification practice statement (sections 21 and 22).
  • Under section 19, the Controller may recognise a foreign Certifying Authority with the Central Government's prior approval, by notification in the Official Gazette.
  • Section 38(2)(c) lets a Certifying Authority revoke a Digital Signature Certificate when its own private key or security system is compromised in a manner materially affecting the certificate's reliability.
  • Section 42 obliges a subscriber to keep control of the private key and report its compromise to the CA without delay.
  • The IT (Amendment) Act, 2008, in force from 27 October 2009, added section 3A, allowing technology-neutral electronic signatures listed in the Second Schedule.

Practise a UPSC-style question

With reference to the Controller of Certifying Authorities (CCA) in India, consider the following statements:

1. The CCA issues Digital Signature Certificates directly to individuals and companies applying for them.

2. The CCA is appointed by the Central Government under the Information Technology Act, 2000.

3. The Root Certifying Authority of India, run by the CCA, digitally signs the public keys of licensed Certifying Authorities.

Which of the statements given above is/are correct?

  1. (a) 1 and 2 only
  2. (b) 2 and 3 only
  3. (c) 1 and 3 only
  4. (d) 1, 2 and 3
Show the answer

Answer: (b) 2 and 3 only

Answer: (b) 2 and 3 only. The CCA certifies Certifying Authorities, not end users.

Statement 1: incorrect. The CCA issues certificates only to Certifying Authorities; licensed CAs issue Digital Signature Certificates to end users.

Statement 2: correct. Section 17 of the IT Act, 2000 lets the Central Government appoint the Controller of Certifying Authorities by Gazette notification.

Statement 3: correct. The CCA set up the RCAI under section 18(b) to digitally sign the public keys of Certifying Authorities.

Eliminate: statement 1 is wrong, since the CCA certifies only CAs. Out: (a), (c), (d).

Trap: Swapped attribution. The licensed CA's job of issuing certificates to users is pinned on the regulator above it.

Remember: CCA certifies CAs (through RCAI); CAs certify users.

More Explainers

All Explainers

More Sci-Tech current affairs