eMudhra exits global TLS certificate business after weak CA keys

Indian digital trust company eMudhra announced it is voluntarily withdrawing from the global SSL/TLS certificate business, following an incident in which the keys behind eight of its intermediate certificate authorities were found to be cryptographically weak. An independent researcher reported the issue on October 17, and eMudhra revoked all eight intermediates within 14 hours, by October 18.

eMudhra said the weak keys resulted from a flaw in a key wrap and unwrap step during a Key Generation Ceremony held in April 2025, a problem that went undetected through two independent audit cycles over about 18 months. The company said seven of the eight intermediates were never used in production, and the one that was had not issued a single certificate, so no live certificate relied on the weak keys. Browser root programs distrusted the ECC root tied to those intermediates as a precaution; Mozilla removed the root from its trust store, and Google said the removal would reach all Chrome devices on October 27.

eMudhra's chairman said global SSL/TLS makes up about 1% of the company's revenue and that rising compliance costs and free certificates from larger providers had already reduced its appeal, while the incident drew scrutiny out of proportion to its size. eMudhra is offering affected customers free replacement certificates, including alternatives from Sectigo, and says its other services, including eSign, CertiNext, and SecurePass, run on separate infrastructure and are unaffected.

Why it matters

The episode shows how a single flawed key-generation step can force a certificate authority out of a market and leave enterprises scrambling to check less-visible trust stores.

Source: eMudhra