eMudhra Has Quit TLS. The Accountability Questions Haven’t

extract

On October 27, Google removed eMudhra’s root certificate called emSign ECC Root CA – G3. Any website still relying on it began showing Chrome users a full-page security warning. This action follows a series of events that unfolded in mid-October with Bengaluru-based eMudhra, India’s largest licensed certifying authority, at the centre of it all. A researcher had shown that the private keys of eight certificate authorities under eMudhra’s global hierarchy were so weak that anyone could work them out. One of them was the number 4. What followed was swift action, at least outside India. All major browser makers blocked the certificates within hours. Software maintainers shipped emergency patches and eMudhra revoked the certificates. Within five days of the vulnerability being reported, eMudhra’s board decided to exit the global TLS certificate business altogether. However, in India, the response to this security incident has been noticeably slower. The IT ministry (MeitY) has formed a special team to investigate and CERT-In issued an advisory four days after the initial report of the vulnerability. While eMudhra has walked away from a business that it says contributes 1% of its revenue, the question is who holds a certificate authority accountable in India? What rules may have been broken by eMudhra in the process of this still-developing situation, and what could the penalties be? How The Browsers Shut The Door The trouble began well before October. The eight keys were created at a single key ceremony, the formal process in which a certificate authority generates its keys, on April 30, 2025. Industry rules require such ceremonies to follow a written script, to be watched by a qualified auditor or recorded on video, and to be signed off in an auditor’s report. eMudhra claims a flaw in its script created a second, weak set of keys, which were used by mistake because their labels looked similar. Each key should have been about 116 digits long; all eight were below 256. The flaw went undetected for about 18 months, across two audit cycles. “I don’t know. We went through two external audit cycles,” said Kaushik Srinivasan, cofounder, eMudhra, calling it “a one-off, a bad day.” An auditor’s report is due in two to three weeks. Once a researcher flagged the weak keys on October 17, the response from browser makers was immediate. Google was swift on its feet by reacting in an hour and 40 minutes later after it received the researcher’s report on October 17. Google’s Chrome had blocked the six website-securing certificates through CRLSet, a blocklist it pushes to browsers without needing an update or restart. Mozilla moved almost as fast. It blocked the certificates in Mozilla Firefox within hours of receiving the report. It also released browser updates and is updating its wider certificate store to protect other applications. Apple followed on October 19 with patches for Safari and Microsoft on October 20 for Edge and legacy versions of its browsers. These companies — some of the biggest tech companies in the world — then went a step further. So on October 20, Mozilla removed the emSign ECC Root CA – G3 root from its trusted list, and Chrome removed it from the Chrome Root Store, effective October 27. It is also said at the time that it is investigating whether eMudhra’s remaining roots should stay in Chrome. Removing eMudhra’s root access is a heavier step than blocking a certificate. It means that a user’s operating system, web browser, or software application no longer automatically trusts or accepts digital certificates issued by that affected Certificate Authority (CA) or tied to that specific root key. There was one piece of reassurance. Chrome said no website certificate from the six intermediates had appeared in public Certificate Transparency logs before its block, so none could have been used against Chrome or other software that requires such logging. Where TLS Fits In eMudhra’s Business eMudhra was founded in 2008 and listed on the BSE and NSE in 2022. Among its customers, Government and defence account for 30% of its revenue, banking and financial services for 25%, and other enterprises for 45%. It operates mainly in two lines of business: enterprise software and trust services. Enterprise software is now the core of the business. It sells platforms like emSigner, for digital document signing; SecurePass, for identity and access management; CertiNext, which helps organisations track and renew their certificates. Trust services is the certificate business. eMudhra issues digital signature certificates, which are electronic identities used to legally sign digital documents, verify the signer’s identity, and file online forms. In India, the Controller of Certifying Authorities (CCA) regulates and permits CAs like eMudhra to issue digital signature certificates. Users could buy a digital signature certificate either for themselves or for an established organisation on eMudhra Digital website. The company said it handled digital signatures for India’s income tax, GST, customs and company law filings. Additionally, eMudhra also offers electronic signature or eSign services. It is an Aadhaar-based electronic signature service that allows individuals and businesses to sign documents remotely without physical paperwork. In 2015, CCA empanelled eMudhra as an authorised eSign service provider. Outside India, eMudhra issues digital signature certificates to individuals and organisations under its own emSign root brand, and is licensed or approved as a provider by governments including Kenya, UAE, and Mauritius. It is accredited by the independent audit and assurance program called WebTrust. eMudhra’s trust services also include SSL/TLS certificates, the digital credentials that secure websites, sold under the same emSign brand. A website owner buys a certificate from a certificate authority (CA) such as eMudhra. When someone visits the site, their browser checks whether the certificate comes from a CA it trusts. If it does, the browser encrypts the connection and shows the padlock; if not, it warns the visitor away. That trust is decided by browser makers such as Google, Apple, Mozilla and Microsoft, which keep their own lists of approved CAs and set the rules those CAs must follow through the CA/Browser Forum — a voluntary industry consortium of CAs and web browser vendors. According to the company, the customers for this service included a university federation in the US, and a few government departments and private sector companies outside the US. Following the distrust action, On October 22, eMudhra announced that it has decided to wind up this SSL/TLS certificate business, withdrawing not just the affected G3 root, but also G1 root. “The impact has been quite severe over the last 24-48 hours. Given the risk to the rest of the business and our obligations as a publicly listed company, the board felt it was prudent to withdraw from this business,” said Srinivasan. The company also cited rising compliance costs, declining returns and limited revenue contribution as the reason behind the move. The segment accounts for around 1% of this publicly listed company’s global revenue. The company reported revenues of ₹701.6 Cr in FY26. The segment’s future commercial prospects also triggered the closure. With Let’s Encrypt offering free TLS certificates and Cloudflare planning to do the same, Srinivasan said the commercial return from the business looks limited, particularly as browser guidelines move towards 90-day certificates. MeitY has drawn the line in its official statement on the matter that the incident concerns eMudhra’s internationally audited website and software certificates, and that its Indian DSC and eSign services remain unaffected. The Question Of Accountability That distinction matters for accountability. As a licensed certifying authority, under the IT Act, the company is obliged to use secure procedures, disclose facts that may affect its reliability. Additionally, Information Technology (Certifying Authorities) Rules, 2000, requires the certifying authority’s operations to be audited every year, with each audit report sent to the CCA within four weeks. IFF argues these duties still reach the emSign business, because eMudhra’s own staff ran the failed ceremony. CERT-In’s role raises its own questions. Its 2022 Directions require companies to report any of 15 listed types of cyber incidents, including the compromise of critical systems or information, within six hours of noticing them. CERT-In’s advisory says eMudhra reported the compromise, but not when. Finally, the data protection law. The DPDP Act’s security safeguards and breach-notification duties take effect only on May 13, 2027, and they apply to personal data. eMudhra says no customer data was accessed. If personal data had been breached, the DPDP Act, once in force in May 2027, would require the company to inform affected users and the Data Protection Board without delay and file a detailed report with the Board within 72 hours. Failing to report a breach can draw a penalty of up to ₹200 Cr, and failing to maintain reasonable security safeguards up to ₹250 Cr, explained Akshayy S Nanda, Partner, Saraf & Partners. “A weak or vulnerable key would not, by itself, establish that a personal-data breach occurred. However, it could allow malicious actors to create web pages or sites that appear legitimate and pass security checks,” said Nikhil Jhanji, principal product manager at IDfy, which runs the DPDP compliance platform Privy. Jhanji added that organisations using eMudhra’s services should review their vendor-risk practices, and that the incident should prompt a review of other vendors handling personal data. So far, the only penalty eMudhra has faced is the one the browsers imposed. Indian law offers several more, but most come with a catch. The heaviest Indian lever, licence revocation, would hit the DSC business that did not fail, rather than the TLS business that did. That mismatch is the core of the governance gap. “As far as the IT Act is concerned, the penalties are fairly dated. Compared to the kind of damage and losses people suffer, they don’t necessarily reflect the risks and threats that the ecosystem faces today and are not proportionate to the level of risk exposure in the market, and I would say they are very modest,” said Shreya Suri, Partner at law firm CMS INDUSLAW. “CERT-In is a reporting and investigative agency, and in cases of non-compliance, it can be called upon to take action. As far as penalties go, a licence suspension or revocation would be the most disruptive consequence for a business and its operations, and it would send a strong message,” she added. Will eMudhra Be Investigated? The magnitude of the incident complicates the picture too, even though eMudhra has consistently tried to play it down. While no attack using the keys has been reported, the keys were effectively public for about 18 months, around 30,000 certificates were affected for a single US client, and software makers shipped emergency fixes. All of this suggests the situation is a lot more serious than what eMudhra has publicly stated. Even the IT Ministry (MeitY) calls the Indian impact limited, despite the fact that many key government websites, including the Aadhaar issuer UIDAI and the income tax filing portal, use digital certificates or other technology from eMudhra. There’s also a matter that came up in the early days of the vulnerability being disclosed and reported. Devices that cannot be updated may keep trusting the bad certificates for longer and this leaves a whole chunk of web-connected devices vulnerable to attacks. Government departments do initiate investigations in such matters involving cybersecurity issues and lapses, but they tend to focus more on damage control than on accountability for what has already happened, said CMS INDUSLAW’s Suri. Investigations identify vulnerabilities and gaps in systems, determine how they can be mitigated, and establish measures to keep systems up to date. Organisations may also conduct annual audits. These are all remedial actions aimed at preventing a recurrence. “That forward-looking approach is better than nothing, but there is still a lack of accountability for what has already happened. As things stand, I don’t think there is any quantifiable accountability in terms of the consequences faced by those responsible,” she added. The Cost For India India has been on the receiving end of browser enforcement before. In 2014, after the National Informatics Centre misissued certificates for Google domains, Google restricted the India CCA root to a handful of Indian domains such as gov.in and nic.in. The bill for eMudhra is a small revenue line and a large reputational one. The bill for India may last longer. eMudhra was a major Indian root certificate authority trusted by browsers worldwide. Once its exit is complete, Indian websites may have to depend largely on foreign certificate authorities for the padlock in the address bar. “When news like this comes out about a company that supports our PKI infrastructure, it raises concerns about both the company’s reputation and the country’s reputation… People may start to question whether PKI infrastructure provided by Indian companies can be trusted,” said Abhijeet Zilpelwar, cofounder and CTO of pi-labs. The assurance that India’s own DSC and eSign systems are unaffected also rests, for now, largely on eMudhra’s claims and accounts. The company has told Mozilla and other browsers it will re-verify every key ceremony it has run. Until someone independently checks that work, Indian users have only the company’s word and MeitY’s preliminary view. But what we have seen is a complete breakdown of the trust in a company whose entire business hinges on trust. Will eMudhra end up paying a bigger price for this mistake than it has so far? [Edited by Nikhil Subramaniam]