eMudhra to exit global SSL/TLS certificate business after security incident

Bengaluru-based eMudhra has decided to exit the global website authentication certificate business following a security incident in which eight of its intermediate security certificates were found to have weak private keys, raising concerns over the security of digital certificates used to authenticate websites.

The company’s board took the decision on October 22. Chairman V Srinivasan said eMudhra had revoked the affected certificate authorities within 14 hours of discovering the issue, Moneycontrol reported on Thursday.

The incident involved SSL/TLS certificates, which help browsers verify the authenticity of websites and establish encrypted connections with them. The company said the incident did not involve a breach of its infrastructure or data, and that the affected certificates had not been used to issue certificates to individual websites or end users.

Srinivasan said the business accounts for around 1% of eMudhra’s global revenue, adding that the scrutiny following the incident had also influenced the board’s decision.

How the certificate vulnerability emerged

The incident came to light on October 17, when a researcher known as Wayne reported that the private keys of eight eMudhra intermediate certificates had been compromised. The certificates had been created on April 30, 2025, during a key-generation ceremony.

According to information provided by the company, the system generated two sets of keys alongside the strong keys, including a weak set that was subsequently published to browser trust lists. eMudhra said the keys were generated using certified hardware security modules, while the root cause of the vulnerability remains under investigation.

Google said the eight certificates were compromised because their private keys had been generated using insufficient randomness, making them extremely easy to guess or recover.

A compromised private key can allow an attacker to impersonate a certificate authority and potentially issue fraudulent HTTPS certificates. Mozilla warned that the compromised keys could be used to issue fraudulent certificates for websites, creating security risks for businesses and internet users.

Google, Mozilla and Apple blocked the affected certificates, while eMudhra said it had revoked all eight.

The vulnerability reportedly remained undetected for around 18 months, despite two independent audits. The company is investigating how the weakness went unnoticed.

Customer transition and other services unaffected

eMudhra said it would work with browser makers and customers to ensure a smooth transition. It will replace affected customer certificates free of cost through its partners and continue providing certificate status and revocation services until all issued certificates expire or are replaced.

The company operates two distinct businesses: digital signature certificates and eSign services, and website authentication and code-signing certificates under its emSign brand. It is a licensed Certifying Authority in India under the Information Technology Act and says it has issued more than 60 million digital certificates.

The company said its Indian digital signature certificate, eSign and other enterprise services remain unaffected by the decision.

The exit marks a strategic change for eMudhra’s global certificate business as it addresses the consequences of the security incident and works to ensure customers can transition to replacement certificates without disruption.