eMudhra To Exit Certificate Business As Security Flaw Triggers Distrust

retained text

eMudhra is exiting its TLS certificate business after a security incident involving weak private keys across eight intermediate CA certificates triggered browser distrust
Cofounder Kaushik Srinivasan says the decision reflects both the incident’s fallout and declining commercial prospects amid free certificate providers and shorter certificate validity periods
The company will transition existing customers to alternative providers free of charge, while strengthening security controls and refocusing on its core enterprise business
Bengaluru-based cybersecurity company eMudhra, which recently found itself at the centre of a security key issue, has announced plans to voluntarily wind down its global secure sockets layer and transport layer security (SSL/TLS) certificate business.
In a filing, the company said that the decision followed a security incident in which a researcher discovered that the private keys of eight intermediate certificate authority (CA) certificates were weak enough to be recovered. The discovery prompted browser root programmes, including Google and Mozilla, to distrust eMudhra’s certificates, affecting its global TLS business.
eMudhra said it revoked the affected CAs within 14 hours of discovering the incident and disclosed it promptly. It added that no end-entity certificates had been issued by the affected CAs, its infrastructure remained uncompromised and no data was breached.
“The impact has been quite severe over the last 24-48 hours. Given the risk to the rest of the business and our obligations as a publicly listed company, the board felt it was prudent to withdraw from this business,” Kaushik Srinivasan, cofounder, told Inc42.
The company also cited rising compliance costs, declining returns and limited revenue contribution as the reason behind the move. The segment accounts for around 1% of its global revenue. The company reported revenues of ₹701.6 Cr in FY26.
The segment’s future commercial prospects also triggered the closure. With Let’s Encrypt offering free TLS certificates and Cloudflare planning to do the same, Srinivasan said the commercial return from the business looks limited, particularly as browser guidelines move towards 90-day certificates.
“The board evaluated the social media reaction, but also took cognisance of the ROI, future potential and competitive landscape,” he said, adding that eMudhra would focus on more complex customer problems in areas such as AI and quantum computing.
What Does This Mean For eMudhra’s Customers
eMudhra said existing customers would be transitioned to alternative certificate providers free of charge over the next three to four weeks, with the company working with other certificate partners to avoid service disruptions.
Srinivasan said the distrust of its G3 ECC root had already affected around 30,000 certificates in the US, which were transitioned to its G1 RSA root. To be sure, G1 and G3 are eMudhra’s root certificate hierarchies: G1 uses RSA cryptography, while G3 uses elliptic curve cryptography (ECC). Google and Mozilla distrusted G3 as a precaution following the security incident, while G1 continues to operate and issue certificates. All certificates in India and various adjoining markets were issued from the G1 root.
However, the G3 root distrust impacted an undisclosed US client. “It resulted in around 30,000 certificates in the US market being affected because they were under ECC. We had to transition them to RSA. Following our announcement, we have to transition them to another provider. We are actively working on that,” Srinivasan said.
The Incident That Shook The World
On October 17, researcher Wayne notified browser root programmes and eMudhra that he had recovered the private keys corresponding to eight intermediate certificate authority (CA) certificates. The keys had been generated with insufficient randomness, making them vulnerable to reconstruction.
Such keys could potentially be used to issue fraudulent certificates for websites or software, although eMudhra said none of the eight intermediates had issued end-entity certificates. Six were intended for TLS and two for software signing. Browser root programmes from companies like Mozilla and Google moved to block the affected TLS intermediates.
eMudhra, at the time, said the certificates were created on April 30, 2025, and had undergone independent audits, though it did not name the auditors or disclose the audit scope. The company said only one affected intermediate was deployed in production, none had issued end-entity certificates, and all eight had been revoked.
The incident prompted a worldwide reaction, casting aspersions on eMudhra’s security controls and the reliability of its certificate issuance processes. Security experts were also unsatisfied with eMudhra’s clarification on the matter.
Responding to this, Srinivasan said that it was a script error and a human oversight problem; no hardware problem was found. “We will share the facts in due course, and this will also be verified through independent research. It was a one-off, a bad day. That’s exactly what happened.”
Notably, the flaw went undetected for around 18 months, spanning two independent audit cycles.
Srinivasan said eMudhra will now appoint an auditor to prepare the final report on the incident, which would take 2-3 weeks. Further, the company would strengthen internal accountability, maker-checker controls and independent reviews for critical processes such as key generation. The company is also exploring AI-based checks to detect weaknesses and flag potential errors.
[Edited by Akshit Pushkarna]