“Global SSL/TLS is a small part of eMudhra’s business contributing to about 1 percent of the global revenue,” the company explained — and with that ratio in hand, eMudhra has decided to walk away from issuing global SSL/TLS certificates entirely.
eMudhra’s decision to abandon global SSL/TLS
On Thursday the Indian certification authority eMudhra said its board concluded that withdrawing from the global SSL/TLS business was “the right decision for eMudhra and its shareholders.” The firm pointed to intense social-media scrutiny, rising compliance and data-sovereignty costs, and competition from free certificate providers as factors that made the arm difficult to justify. eMudhra described global SSL/TLS as a minor revenue stream — about 1 percent of global revenue — and said the scrutiny “is out of proportion to SSL/TLS’s place in our business.”
The weak keys that triggered the exit
Two days after the company’s weak private keys were exposed in public reports — following a report to Mozilla on October 17 — the incident remained the proximate cause of the decision. Security researchers recovered eight affected private-key values tied to intermediate certificate authorities; those values ranged from the single digit 4 up through 56, 66, 115, 155, 156, 230 and 237. The keys belonged to eight intermediate CAs, which, the reporting warned, potentially allowed attackers to forge certificates trusted by systems that hadn’t blocked them. eMudhra maintains the affected CAs had issued no end-entity certificates.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleCompany explanation: a ceremony flaw, audits, and browser roots
eMudhra acknowledged the weak keys and offered an account of what went wrong. “A flaw in the key generation ceremony caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys,” the company said, and added that the weak keys were the ones published to the browser root stores. The firm also noted that the relevant certificate infrastructure had undergone two years of independent audits and had been in browser trust lists since mid-2025 — a combination that, the company said, raises questions about timing and detection but does not, in its view, indicate a compromise.
eMudhra said it revoked the affected CAs within 14 hours of discovering the issue, and that “neither its infrastructure nor its data had been compromised” as a result.
Operational impacts: revocation, transitions, and remaining services
Despite the business exit, eMudhra said it will meet immediate operational responsibilities while it winds down: it will continue to serve G1 RSA roots until customers are transitioned to other certificate issuers, and it will transition customers free of charge. “Revocation and certificate status services will keep running until every issued certificate has expired or been replaced,” the company said. eMudhra also pledged to publish a root-cause report and to fulfill remaining commitments to browser root programs as part of the phase-out.
What this means for technologists, enterprises, and the public
- Technologists and security teams: will need to verify whether any local trust stores or devices retain the now-revoked intermediate CAs, track revocation and certificate-status services while those services remain active, and accept or orchestrate free transitions to replacement issuers.
- Enterprises and procurement leaders: are likely to plan for certificate replacement and to take up the company’s offer to migrate affected customers at no charge; they will also weigh the operational cost and compliance burdens eMudhra cited when choosing future certificate vendors.
- End users and the general public: the company’s claim that the affected CAs issued no end-entity certificates reduces the immediate customer-facing threat, but the exposure of weak intermediate keys underscored the risk that, until CAs are revoked or blocked, attackers could theoretically forge certificates that appear trusted by systems that have not acted.
eMudhra’s exit closes a brief but highly visible chapter of its certificate business: the company will continue to operate enough services to retire or replace outstanding certificates and to publish a root-cause report, but it has chosen to cede the global SSL/TLS market rather than absorb further scrutiny. The episode leaves a pointed question embedded in eMudhra’s own timeline — if the certificate infrastructure underwent two years of independent audits and entered browser trust lists in mid-2025, why were weak keys published to those stores in the first place? eMudhra says it will answer that in its forthcoming report.
