eMudhra quits the global SSL/TLS certificate business after weak keys

eMudhra, the Indian certificate authority behind this week's emergency browser fixes, is leaving the business that caused them. Its board has decided to "voluntarily withdraw from the global SSL/TLS certificate business," the company said on October 22, 2026. Its other digital trust services, such as digital signatures, carry on.

The decision comes five days after a researcher reported that the keys behind eight eMudhra intermediate certificates were exposed. Browsers blocked those certificates within hours, and Go, Firefox, NSS and Python's certifi shipped fixes. An intermediate certificate sits between a CA's root and the website certificates it signs, so a leaked intermediate key lets an attacker mint certificates for any domain.

Why eMudhra is leaving

In the eMudhra press release, chairman V. Srinivasan says global SSL/TLS brings in about 1% of the company's global revenue. The release points to rising data sovereignty and compliance demands, which make the business more complex and costly each year. Some large providers also issue certificates for free. Together, the release says, that has cut the return on this line of business.

eMudhra framed it the same way to CyberScoop. "For many certifying authorities, SSL/TLS is the whole business," the company said. "For eMudhra it is one part of a much broader digital solutions portfolio." CyberScoop reports that Srinivasan also called the social media scrutiny out of proportion to the unit's size.

eMudhra's account of the key failure

eMudhra says it revoked the affected CAs within 14 hours of discovery. It says no end-entity certificates, the ones customers actually use, were issued from them, its infrastructure was not compromised and no data was breached.

Cyber Security News sums up the company's early explanation. During a key ceremony on April 30, 2025, a flawed script in a key wrap and unwrap step created a second, weak set of keys. Because the key labels looked alike, staff used the weak keys instead of the strong ones. eMudhra has promised a full root-cause report but has not said when.

Nobody knows yet whether anyone abused the keys. India's cyber agency, CERT-In, said on October 21 that public reports had not confirmed any malicious use. CyberScoop reports that Indian authorities have opened an investigation and that eMudhra's shares fell about 40% in the two days after the disclosure.

What happens to existing certificates

According to Cyber Security News, eMudhra's G1 RSA roots will keep serving customers during the transition. Customers will get replacement certificates through partners at no cost. Revocation and status checks will keep running until each certificate expires or is replaced. The outlet puts the number of certificates that need to move at about 30,000.

Several details are still missing. eMudhra has not named its partners or set an end date for the transition.

The browsers are not waiting either. Google and Mozilla are moving to drop trust in the emSign ECC Root CA - G3 root, which signed the weak intermediates. CERT-In expects Chrome's root store change to reach devices on October 27. CyberScoop adds that Google is reviewing eMudhra's remaining root as well.

What this means for developers

If you hold an eMudhra certificate, plan the move now rather than at its expiry date.

• Find every eMudhra and emSign certificate you rely on. Check the issuer on your public sites, load balancers, internal services and vendor endpoints. Certificate Transparency logs list every public certificate issued for your domains.
• Replace early. The G1 RSA roots still work today, but Google is reviewing eMudhra's remaining root. If a browser drops a root, every certificate under it fails for that browser's users at once.
• Get the replacement details in writing. Ask which partner CA will issue your free replacement, then test the new chain on every client you support before you switch.
• Ask about code signing separately. Two of the eight weak intermediates signed software. eMudhra's announcement covers SSL/TLS and does not say what happens to its code-signing certificates.
• Keep your trust stores current. The browser fixes from this week do not reach Go binaries, Python environments or container images until you update and rebuild them.