Indian digital trust and cybersecurity company eMudhra has decided to voluntarily exit its global SSL/TLS certificate business following a security incident involving eight intermediate certificate authority (CA) keys that were found to be dangerously weak. The issue prompted major technology companies, including Google, Mozilla, Apple and Microsoft, to block the affected certificates from their browser trust systems.
The company’s board decided to withdraw from the business amid rising compliance costs, increasingly complex data sovereignty requirements and declining returns from a segment that contributes approximately 1% of its global revenue. The decision comes as the incident draws attention to the security infrastructure that enables browsers to authenticate websites and establish encrypted connections.
The affected certificate authorities were associated with eMudhra’s emSign ECC Root CA infrastructure. According to the company, a flaw during key generation resulted in a second set of weak cryptographic keys being created alongside the intended strong keys. The weaker keys were subsequently published to browser root stores, leaving them trusted by major browser ecosystems before the vulnerability was discovered.
How the Security Vulnerability Occurred
The eight intermediate certificate authorities were generated during a key generation ceremony on April 30, 2025, using hardware security modules, according to eMudhra’s earlier disclosure. The company said a flaw in the key generation process caused a wrapping and unwrapping operation to produce weak keys in addition to the intended strong keys.
The incident remained undetected for approximately 18 months. On October 17, an independent security researcher discovered that the weak private keys could be reverse-engineered from their corresponding public keys and reported the issue to major browser root programmes.
An advisory issued by India’s Computer Emergency Response Team (CERT-In) on October 21 described the vulnerability as high severity. The affected private keys used the P-384 elliptic-curve cryptographic system, but their values were so weak that they could reportedly be recovered almost instantly. The Internet Freedom Foundation, a digital rights organisation, said one of the weak keys was the number four.
Of the eight affected intermediate certificate authorities, six were capable of issuing website security certificates, while two could issue code-signing certificates. This distinction is significant because certificate authorities occupy a critical position in the digital trust ecosystem. If an attacker obtains a trusted certificate authority’s private key, they may be able to issue fraudulent certificates that appear legitimate to software relying on that authority.
For website certificates, such misuse could enable impersonation of legitimate websites, facilitate interception attempts and expose users to credential theft. Compromised code-signing certificates could also be abused to make malicious software appear to have a legitimate digital signature.
Google, Mozilla, Apple and Microsoft Block the Certificates
Major technology companies responded after the vulnerability was reported, moving to prevent the affected certificate authorities from being trusted by their respective systems.
Google said its Chrome Root Program received the report at 18:05 UTC on October 17 and issued a Certificate Revocation List Set (CRLSet) update blocking the affected keys at 19:45 UTC the same day. The update did not require users to manually update or restart Chrome. Google also distributed a similar update to Android devices through Google Play Services on October 19.
Google said no TLS certificates chaining to the six affected website-issuing intermediates had been recorded in Certificate Transparency logs before the block. According to the company, this meant that no such certificates could have been trusted by default in Chrome.
Google is also removing the emSign ECC Root CA – G3, which signed the affected certificates, from the Chrome Root Store. The change was expected to reach users on October 27, Pacific time. Google has advised website operators whose certificates depend on the affected root to obtain and install replacement TLS certificates from a different public key infrastructure hierarchy.
Mozilla blocked the six website certificate authorities in Firefox through its OneCRL revocation list and released relevant browser updates, according to CERT-In. Apple devices began blocking the affected certificates on October 19, while Microsoft implemented its response on October 20.
Although the browser restrictions are intended to protect users, removing a trusted certificate authority can also create operational challenges. Organisations that continue to rely on certificates associated with the affected trust chain may experience browser warnings, failed connections or other disruptions until replacement certificates are installed.
eMudhra Says No End-User Certificates Were Issued
eMudhra has said it revoked the affected certificate authorities within 14 hours of discovering the issue and disclosed the incident promptly. The company stated that its infrastructure had not been compromised and that no data breach had occurred.
According to its public statement, seven of the eight affected intermediate certificate authorities had never been deployed in production. The company identified only one affected customer ecosystem, located in the United States.
Chairman V. Srinivasan said the level of public attention surrounding the incident was disproportionate to the SSL/TLS business’s importance within the company’s broader operations. He also pointed to rising operational complexity and compliance costs, alongside competition from providers offering certificates at little or no cost.
The company’s decision to exit the business therefore reflects both the immediate consequences of the security incident and its assessment of the segment’s long-term commercial viability.
However, the distinction between a security vulnerability and confirmed malicious exploitation remains important. CERT-In noted that public disclosures had not established confirmed malicious exploitation as of October 21. The reported weakness created the potential for serious abuse, but the available information did not establish that attackers had successfully used the affected keys to compromise customers.
What the Exit Means for Customers
eMudhra has said its G1 RSA root certificates will continue serving customers until the transition is completed. The company plans to replace affected certificates free of cost through its partners and has identified certificates issued by Sectigo as an alternative for customers requiring replacement services.
Certificate revocation and status-checking services will remain operational until all issued certificates have expired or been replaced. eMudhra has also committed to completing its remaining obligations to browser root programmes, including providing a comprehensive root-cause report. The company has not announced a definitive timeline for its exit from the global SSL/TLS certificate business.
Customers using affected certificate chains will need to assess their systems and replace certificates where necessary. Website operators should verify their certificate dependencies, install replacements from an unaffected certificate authority and confirm that their services function correctly across major browsers.
The transition could require coordination among eMudhra, its partners, enterprise customers and website administrators. Organisations with complex infrastructure may need to update certificates across multiple domains, services and applications to avoid interruptions.
Indian Digital Signature and eSign Services Remain Unaffected
eMudhra has emphasised that the incident is limited to its browser-trusted SSL/TLS certificate business and does not affect its other digital trust operations.
The company said its digital signature certificate (DSC) and eSign services in India remain unaffected, alongside its emCA and CertiNext public key infrastructure platforms, emSigner eSignature suite, and SecurePass and emAS identity products.
CERT-In also clarified that the advisory concerned the browser-trusted certificate business. eMudhra’s Indian DSC and eSign services operate under the regulatory framework overseen by the Controller of Certifying Authorities.
The separation between these services is important for customers evaluating whether the incident affects their existing relationship with the company. Nevertheless, organisations should rely on official communications and their own technical assessments to determine whether any specific certificate or service requires action.
Digital Rights Group Seeks Independent Review
The Internet Freedom Foundation wrote to eMudhra, CERT-In and the Ministry of Electronics and Information Technology on October 21, seeking a comprehensive incident report and independent security audits by auditors who had not previously been engaged for the relevant assessments.
The organisation also sought confirmation that the incident had been handled in accordance with CERT-In’s 2022 directions on cybersecurity incident reporting.
The requests highlight questions about how the weak keys passed through the certificate issuance process and remained within browser trust systems despite earlier audits. The incident has also renewed scrutiny of the testing, monitoring and governance procedures used by certificate authorities, whose infrastructure underpins secure communication across much of the internet.
eMudhra’s Financial Position and Business Outlook
eMudhra serves banks, enterprises and government organisations in more than 35 countries. According to the company’s investor presentation, it reported total income of ₹713.2 crore and profit of ₹110 crore in FY26.
With SSL/TLS certificates contributing approximately 1% of global revenue, the business would account for an estimated ₹7 crore annually, based on the reported revenue figure. The relatively small contribution gives the company a commercial rationale for withdrawing from a segment facing increasing compliance requirements and competitive pressure.
In the June quarter, eMudhra’s total income rose approximately 28% year-on-year to ₹192.5 crore, while profit increased around 28% to ₹32 crore. International markets accounted for 66% of revenue during the period. The company has also described itself as the only Indian certificate authority listed in major browser trust stores.
The board is scheduled to meet on November 4 to approve the September-quarter results, followed by an earnings call on November 5. These updates may provide further information about the company’s financial performance and the operational implications of its decision to exit the certificate business.
A Significant Reminder About Digital Trust Infrastructure
The eMudhra incident demonstrates how weaknesses in cryptographic key generation can undermine the trust placed in digital certificates, even when the broader infrastructure has undergone audits. Certificate authorities play a foundational role in internet security, and failures involving their private keys can have consequences extending beyond an individual company.
The coordinated response from browser providers illustrates the importance of rapid vulnerability disclosure, certificate revocation and replacement procedures. At the same time, the incident raises questions about audit effectiveness, cryptographic implementation and the need for continuous verification of systems that underpin digital trust.
For eMudhra, the exit marks a strategic shift away from a relatively small part of its business. For customers and the wider technology industry, the priority remains ensuring that affected certificates are replaced, services continue operating securely and the underlying causes of the weakness are fully understood.
Disclaimer: This report has been editorially prepared using publicly available information and official company disclosures. Readers are advised to refer to official company announcements and disclosures for further details.
Author
About the Author
