eMudhra Limited has decided to withdraw from the global SSL/TLS certificate market following the exposure of vulnerabilities in several intermediate certificate authority (CA) certificates. The company’s decision, announced on October 22, 2026, comes after emergency interventions by major browsers and increasing scrutiny over its certificate issuance practices. Despite this exit, eMudhra assures that its other digital trust services remain unaffected.
Company Announcements and Immediate Actions
In an official statement, eMudhra’s board sanctioned the voluntary withdrawal after assessing both the incident and future business prospects. Chairman V. Srinivasan highlighted that the company revoked the compromised CA certificates within 14 hours of detecting the issue and promptly informed stakeholders.
eMudhra clarified that none of the compromised intermediates had issued end-user certificates, which are typically used by websites or software publishers. They further assured that their infrastructure remained secure, with no data breaches or security control failures.
Root Cause and Industry Reactions
The incident originated from an October 17 report by a researcher known as Wayne, who demonstrated control over eight private keys, leading to Mozilla’s independent verification of a severe key generation flaw. Among the affected certificates, six were for TLS, and two were for code signing.
The issue stemmed from insufficient randomness in the key generation process. CERT-In reported that the compromised P-384 elliptic-curve private keys had unusually small values, making them easily recoverable from public keys. This problem was linked to a flawed script used during a key-generation ceremony in April 2025.
Implications and Future Steps
The incident led to immediate actions from major browsers, including blocking the affected TLS keys and initiating the removal of trust in specific eMudhra CA roots. Google and Mozilla’s interventions were aimed at protecting users whose systems might not automatically receive revocation updates.
eMudhra noted that approximately 30,000 certificates would need migration, although these do not include those issued by the weak intermediates. The company also acknowledged the broader ramifications of CA failures, exemplified by past actions from Google to remove certain certificate authorities.
Despite SSL/TLS forming only a small part of its revenue, eMudhra cited increasing compliance costs and competition as reasons for its strategic shift. The company plans to maintain its RSA roots during the transition, offering replacement certificates through partners at no charge.
CERT-In advises administrators to update trust stores, review certificate chains, and replace susceptible certificates. Security teams should also reassess application and network device certificates to ensure comprehensive protection.
