eMudhra Exits Global SSL/TLS Certificate Business After Weak Key Vulnerability
eMudhra is exiting the global SSL/TLS certificate business following the disclosure of weak private keys in eight intermediate CA certificates, prompting emergency browser actions and forcing thousands of certificate migrations.
eMudhra Limited has announced its voluntary exit from the global SSL/TLS certificate business, a decision stemming from the recent disclosure of weak private keys affecting eight intermediate certificate authority (CA) certificates. This move comes after emergency protections were implemented by major browsers and amidst growing scrutiny of the company's certificate issuance controls. While eMudhra assures that its other digital trust services remain unaffected, the board's approval of the exit signifies a significant strategic shift.
According to Chairman V. Srinivasan, the affected CA certificates were revoked within 14 hours of discovery, and the issue was promptly disclosed. The company emphasized that none of the compromised intermediate CAs had issued end-entity certificates, meaning the certificates directly used by websites or software publishers were not directly affected. Furthermore, eMudhra stated that its infrastructure was not breached, no data was compromised, and all physical and logical security controls remained intact throughout the incident.
The vulnerability originated from a flawed script used during a key generation ceremony on April 30, 2025. This script created a second, weak set of P-384 elliptic-curve private keys. Due to similar key labels, staff inadvertently used these weaker keys in certificate signing requests instead of the original, strong keys. The issue was brought to light on October 17, 2026, when a researcher reported that they had proof of control over eight private keys, which Mozilla later independently recovered and confirmed as flawed.
The technical flaw involved a lack of randomness in the key generation process, resulting in P-384 elliptic-curve private keys with values smaller than 256 bits. This weakness allowed for the keys to be recovered almost instantly from their public keys, a critical failure in the cryptographic process. While the P-384 algorithm itself is sound, the implementation during eMudhra's ceremony was severely compromised.
In response to the disclosure, browsers like Google Chrome and Mozilla Firefox took emergency action. They blocked the affected TLS keys and initiated steps to distrust specific eMudhra root CAs. This distrust mechanism is crucial for clients that may not reliably receive or enforce intermediate certificate revocation information. Google Chrome's root store change was expected to be implemented on devices by October 27, 2026, creating a migration challenge for legitimate customers.
eMudhra estimated that approximately 30,000 certificates required migration due to the browser actions. While public disclosures as of October 21, 2026, had not confirmed malicious exploitation, the potential for attackers to issue false certificates and impersonate websites was significant. The incident highlights the far-reaching consequences of CA failures, similar to past instances where browser trust decisions forced website operators to replace otherwise valid certificates.
The company cited several factors contributing to its decision to exit the SSL/TLS business, including rising data sovereignty requirements, compliance costs, and increased competition from free certificate providers, which had reduced the segment's profitability. eMudhra stated that global SSL/TLS contributed only about 1% of its revenue. The company plans to support customers through the transition by providing replacement certificates via partners at no cost and will continue revocation and certificate status services until existing certificates expire or are replaced.
CERT-In has issued an advisory urging administrators to update browsers and trust stores, review certificate chains, and replace affected certificates. The advisory also stresses the importance of checking separate certificate bundles in applications, containers, and network devices, as browser updates may not cover all systems. eMudhra has committed to completing its obligations, including providing a full root-cause analysis report.
Indian certificate authority eMudhra has announced it will cease its SSL/TLS certificate business entirely, a decision that follows the disclosure of weak private keys and subsequent browser blocks. The company's board cited rising compliance costs and competition, alongside the reputational damage from the incident, as reasons for exiting the market. While the company maintains its core infrastructure was not breached, the incident has led to a significant drop in its stock value and prompted an investigation by Indian authorities.