eMudhra, a digital trust company based in Bangalore, has decided to discontinue its global SSL/TLS certificate business. This decision followed a security incident involving weak cryptographic keys that drew the attention of Google and Mozilla.
In an official notice submitted on Thursday, the company stated that its board of directors had decided to voluntarily exit this line of business. Reasons cited by the company include rising compliance costs, increasing data sovereignty requirements, and reduced commercial returns.
This decision came after the discovery of eight intermediate Certificate Authority keys associated with eMudhra that were found to be dangerously weak. These vulnerabilities could potentially have allowed attackers to impersonate legitimate websites. Although the keys were generated in April 2025, their weakness went unnoticed for about eighteen months. Consequently, Google and Mozilla took action to block the affected certificates to protect users.
eMudhra Chairman, V Srinivasan, stated that the company revoked the affected Certificate Authorities within 14 hours of discovering the issue and promptly disclosed the information. The company insists that its infrastructure was not compromised, no data leak occurred, and none of the affected intermediate CAs issued certificates to end-users.
The global SSL/TLS certificates, which are used to authenticate sites and ensure online connection security, accounted for approximately 1% of eMudhra's worldwide revenue. Srinivasan noted that growing data sovereignty and regulatory compliance demands made running this business more complex and expensive. Furthermore, competition from major providers offering SSL/TLS certificates for free reduced its commercial potential and return on investment.
"The level of social media coverage of this incident attracted attention disproportionate to the place of SSL/TLS in our business," commented Srinivasan. He added that the board of directors concluded after careful deliberation that exiting the global SSL/TLS business is the right step for the company and its shareholders.
eMudhra announced that it will now focus its efforts on core enterprise solutions and digital trust services outside the SSL/TLS segment. The company also assured that its G1 RSA root certificates will continue to serve clients during the transition period while it cooperates with browsers and clients to facilitate the revocation process. The company will contact affected customers and arrange for free certificate replacement through partners.
Certificate revocation and status services will be provided until all issued certificates expire or are replaced. eMudhra also committed to fulfilling outstanding obligations to root browsers, including providing a full report on the root cause of the incident. The timeline for completing the exit has not been specified.
The company emphasized that its global SSL/TLS infrastructure operates separately from other business lines, such as the Indian Digital Signature Certificate (DSC) and eSign services. Its enterprise public key infrastructure platforms, including emCA and CertiNext, as well as identification and authentication solutions like SecurePass and emAS, will continue to operate normally. The incident drew close scrutiny from global browser vendors and Indian authorities. Google's Chrome security team warned that weak keys could allow attackers to forge trusted HTTPS certificates, while Mozilla blocked the affected certificates in Firefox. Additionally, India's Computer Emergency Response Team (CERT-In) issued an advisory on October 21, highlighting risks associated with compromised certificate keys.
