eMudhra’s SSL/TLS exit leaves questions over weak-key lapse and security controls

A technical error left eMudhra’s intermediate CAs vulnerable for 18 months, leading to an exit from the global SSL/TLS market and raising severe questions about audit efficiency and key validation.

A key-generation script error on April 30, 2025, produced predictable private keys across eight intermediate certificate authorities at eMudhra Ltd. The flaw remained completely undetected through two separate audit cycles, sparking deep concerns over internal security controls, independent verification, and the safety of the firm's broader product portfolio.

Speaking to Business Today, eMudhra co-founder Kaushik Srinivasan framed the event as a "process lapse, human oversight and a script error that should have been caught by adequate controls." He confirmed the incident triggered no data breach or infrastructure compromise, adding that Indian digital signature certificate (DSC) and eSign businesses remain completely untouched.

Seven of the affected intermediate CAs never saw production; the eighth was deployed but issued zero end-entity certificates. Despite this, industry experts note that a lack of end-user certificates limits immediate impact but does not excuse the underlying control breakdown. Certificate issuance records, key-use logs, and independent forensic findings are still necessary to confirm the scope of exposure.

Murali Rao, Cyber Consulting Leader at EY, described the incident as very serious. "A certificate authority exists to make digital trust dependable. Weak private keys remaining undetected through two audit cycles raise serious questions about what those audits actually verified," Rao said. "The lesson is clear that audits must test the cryptographic keys actually published, not just the procedures on paper."

Rao also pointed to a systemic cybersecurity issue: lack of asset visibility. "If you don’t know what you have, it is impossible to defend or secure," he noted, emphasizing the broader challenge companies face in tracking TLS certificates, software versions, and cryptographic secrets.

eMudhra is exiting the global SSL/TLS business entirely, a vertical accounting for roughly 1% of its revenue, to focus on enterprise solutions and other trust services. However, stepping away from the global market does not absolve the firm from resolving its security gaps. To restore faith, eMudhra must publish transparent technical findings, offer independent proof that other operations are safe, and demonstrate that key-generation processes have been hardened for the domestic market, where its operations continue.