eMudhra Exits Global SSL Certificate Business After Key Flaw

An Indian certificate authority that millions of websites quietly trusted to prove they were legitimate just admitted it can no longer vouch for its own keys — and walked away from that business entirely.

A guessable key is the worst kind of bug

Bengaluru-based eMudhra is one of the companies browsers trust to issue the padlock-icon certificates (SSL/TLS certificates) that tell your browser a website is who it claims to be. Those certificates chain back to an intermediate certificate — essentially a middle link in a trust chain — signed with a private key that's supposed to be mathematically impossible to guess.

In mid-October, a security researcher found that eight of eMudhra's intermediate certificates, six used for website security and two for code-signing, had private keys that weren't random enough to be safe. In plain terms, the keys were generated in a way that made them crackable, which is about as bad as it gets for a certificate authority (CA) — the entire point of a CA is that its keys can't be forged or guessed.

Chrome and Firefox blocked the affected certificates the same day the flaw became public. Apple and Microsoft followed within days. eMudhra says it revoked all eight certificates quickly once it learned of the problem, that none of them had been used to issue certificates for actual websites, and that its core infrastructure was never broken into.

Why exit a business over eight certificates

On October 22, eMudhra's board decided the cleanest fix was to leave the global SSL/TLS certificate business altogether rather than try to rebuild browser trust one audit at a time. The company pointed to rising compliance costs, tightening data sovereignty rules in the markets it serves, and the fact that this line made up roughly 1% of its global revenue anyway — not exactly a business worth fighting for after a trust-destroying incident.

eMudhra says existing customers will get replacement certificates free of cost through its partners, and it will keep handling revocation and status checks until every outstanding certificate expires or is swapped out.

• Eight intermediate CA certificates affected — six TLS, two code-signing
• Chrome and Firefox blocked them the day the flaw surfaced; Apple and Microsoft followed within 48 hours
• eMudhra says no end-entity website certificates were ever issued from the compromised CAs
• The global SSL business being shut was about 1% of the company's revenue

What it actually means for India

Here's the part that matters most for Indian readers: eMudhra isn't just a global CA, it's also one of the licensed Certifying Authorities under India's IT Act, issuing the digital signature certificates (DSCs) and eSign services used for income tax filings, GST registrations, company incorporations, and e-tendering. That domestic business runs on entirely separate infrastructure and keys, and both the company and the Ministry of Electronics and IT (MeitY) have said it was never touched by this flaw.

MeitY has set up a special team to investigate the incident and is coordinating with eMudhra, while CERT-In — India's national cybersecurity response agency — told government departments, internet providers and software vendors to check and update their lists of trusted certificates. The ministry has also pushed back publicly against what it called "fear mongering" around the incident, insisting the fallout has stayed contained to the website-security side of the business.

That containment is a genuine relief, but it doesn't erase the harder question digital rights groups have raised: reports suggest the weak-key problem sat undetected for roughly 18 months, surviving two separate audits along the way. The Internet Freedom Foundation has asked MeitY, CERT-In and the Controller of Certifying Authorities for a full incident report and an independent audit by firms that haven't previously worked with eMudhra.

An SSL certificate is only as trustworthy as the random numbers behind it — and for a few days in October, one of India's own certificate authorities couldn't fully vouch for its own.

For Indian developers and businesses running their own TLS certificates, the immediate to-do list is short but real: check whether any certificate in your chain traces back to eMudhra's SSL/TLS roots, swap it if it does, and make sure your servers' trusted-root lists are current so revoked certificates actually get rejected rather than silently accepted.

The uncomfortable part of trusting a CA

The whole system of web trust rests on a small number of certificate authorities getting key generation right, every time, forever. When one doesn't, browsers can react in hours — but the audits that were supposed to catch this in the first place took 18 months to fail. eMudhra choosing to exit rather than fight for browser trust back says something about how unforgiving that system has become, and it's a reminder that even companies entrusted with national digital-identity infrastructure aren't immune to getting the fundamentals wrong.