allworld.mediaNews from all over the world
eMudhra voluntarily exits global SSL/TLS certificate issuance business due to vulnerabilities
Read more
Business Standard
business-standard.com

eMudhra voluntarily exits global SSL/TLS certificate issuance business due to vulnerabilities

The Indian digital trust service provider eMudhra announced on Thursday its voluntary exit from the global SSL/TLS certificate issuance business following the discovery of vulnerabilities in its digital certificates, which raised concerns regarding digital security.

The discovery of these vulnerabilities led major internet browsers, including Google, Mozilla, Apple, and Microsoft, to block digital certificates issued by eMudhra, sparking wider concern among cybersecurity specialists about internet privacy and security.

SSL and TLS protocols are used to protect data transmitted between web browsers and servers, ensuring that personal information is not intercepted by attackers. eMudhra issues such certificates for government agencies and digital enterprises, including for some online services, such as the Indian tax department portal.

An independent cybersecurity researcher discovered over the weekend that several key certificates issued by eMudhra to secure websites, software, and online communications were weak and susceptible to attacks.

On Wednesday, India's Computer Emergency Response Team also issued a warning about the compromise of some eMudhra intermediate certificates. The company stated in a Wednesday announcement that it had revoked eight of its issued certificates, while emphasizing that its infrastructure and data had not been compromised.

In a subsequent statement, eMudhra noted that the level of media coverage on social networks was disproportionate to the significance of this area for the company, adding that the global SSL/TLS certificate business accounts for only 1% of its revenue. Among eMudhra's clients are Indian IT companies Infosys and TCS.

Following the disclosure of the vulnerability, the company's shares dropped by 40% over two days.

Similar stories

eMudhra undergoes scrutiny over weak certificate keys, raising web security concerns
Read more
yourstory.com

eMudhra undergoes scrutiny over weak certificate keys, raising web security concerns

The company eMudhra has come under intense scrutiny following the discovery of a critical vulnerability in eight intermediate Certificate Authority keys associated with its global website security business. This vulnerability raises serious concerns regarding the systems browsers use to establish trust on the network.

This flaw potentially allowed attackers to create fraudulent HTTPS certificates and impersonate legitimate web resources. According to an eMudhra statement dated October 21, 2026, the keys were generated on April 30, 2025, but the weakness went undetected for about eighteen months.

A Certificate Authority (CA) is responsible for verifying authenticity and issuing digital certificates. Intermediate authorities operate under the umbrella of a root certificate trusted by browsers and operating systems.

eMudhra reported that during the key generation process, a key wrapping/unwrapping stage created a second, weak set of keys, which was subsequently published in browser root certificate stores. Although the company assured that its root private key was not compromised, browser operators took precautionary measures and revoked trust in the associated emSign ECC Root CA - G3 root CA.

Google's Chrome security team warned that this vulnerability allows anyone to forge trusted HTTPS certificates to mimic any site against clients who have not yet removed trust in these CAs. Google has blocked the affected keys and plans to remove the parent root from Chrome's trust store by October 27 Pacific Time. As a result, some legitimate websites using certificates under this root may stop working in Chrome.

Meanwhile, Mozilla blocked the affected certificates in Firefox within three hours of receiving the notification and released software updates to extend protection to users who might not receive automatic protection.

The immediate impact of the incident appears limited, although the investigation is ongoing. eMudhra emphasized that none of the eight affected intermediate authorities issued end-user certificates, its infrastructure was not compromised, and no data leaks occurred. The company identified one affected client ecosystem in the United States where certificate replacement is taking place.

The company also noted that its digital signature and eSign services in India, which operate on a separate infrastructure, remained unaffected. Acknowledging the uncertainty regarding the cause, eMudhra stated: 'We have not yet confirmed the exact root cause. We will publish it fully after completing our investigation.'

This incident highlights a broader issue for the digital trust industry. Encryption can protect communications, but only if the certificates verifying a website's identity are reliable. Therefore, browser manufacturers maintain their own lists of trusted certificates and can revoke acceptance when a provider's control fails.

Public certificate transparency logs also help detect suspicious certificate issuance. A complex question for eMudhra is how a weakness of this magnitude could go undetected during two audit cycles. The company stated that it is reviewing its key generation procedures and is offering corporate clients certificates from an additional Certificate Authority to reduce reliance on a single chain of trust.

Popular