Image: Unsplash (free Unsplash licence) — Illustrative image: a cybersecurity lock screen, representing the website certificates at the centre of eMudhra's exit
📌 KEY HIGHLIGHTS
- The decision: eMudhra's board voted on Thursday 22 October 2026 to voluntarily withdraw from its global SSL/TLS certificate business, after browser makers Google and Mozilla moved to distrust its certificates.
- The trigger: private keys for eight eMudhra intermediate CAs were generated so weakly in April 2025 that researchers recovered them almost instantly — one recovered key was literally the number 4.
- What customers get: eMudhra will replace affected certificates free of charge with Sectigo-issued certificates, and will keep revocation and status services running until every issued certificate has expired or been replaced.
- Why now: the company cites rising compliance costs, data-sovereignty requirements and shrinking returns — global SSL/TLS is only about 1% of its revenue — plus scrutiny it calls out of proportion to that share.
- What is NOT ending: eMudhra's Indian digital signature, eSign and CertiNext businesses continue, and its separate G1 RSA root hierarchy keeps serving customers in the meantime.
What happened?
eMudhra Limited, a Bengaluru-based digital trust company whose emSign brand issues website certificates worldwide, announced that its board had decided to voluntarily withdraw from the global SSL/TLS business. The announcement came in a regulatory filing on Thursday 22 October 2026, five days after a researcher reported recovering the private keys of eight of its intermediate certificate authority (CA) certificates, and two days after India's CERT-In published its advisory on the incident. It is a remarkable ending for a trust business: the company is not being shut down by regulators, but is walking away from the market itself because, in its own words, the scrutiny around the incident is "out of proportion" to a business that brings in only about 1% of its global revenue.
The underlying incident is the one we covered in our CERT-In eMudhra certificate compromise advisory explainer: a flaw in a key-generation ceremony in April 2025 produced a second, weak set of keys alongside the strong ones, and the weak set is what reached the browser root stores. The P-384 elliptic-curve keys should have carried 384 bits of entropy; the compromised ones had as little as 3 to 8 bits, with recovered values including 4, 56, 66, 115, 155, 156, 230 and 237. Whoever holds an intermediate CA key can, in theory, mint a trusted certificate for any website. eMudhra says it revoked the affected authorities within 14 hours of discovering the incident, that its infrastructure was not compromised, that no data was breached, and that none of the eight intermediates ever issued an end-user certificate.
eMudhra exits global SSL TLS certificate business — the timeline
| Date | What happened | Why it matters |
|---|---|---|
| 30 Apr 2025 | Key-generation ceremony produces a weak second set of keys alongside the strong ones | The flaw goes undetected for about 18 months, through two audit rounds |
| 17 Oct 2026 | Researcher reports the recoverable keys to Apple, Google, Microsoft and Mozilla | Browsers begin blocking the affected certificates within hours |
| 20–21 Oct 2026 | Mozilla distrusts the root; CERT-In publishes advisory CIAD-2026-0050; eMudhra files its stock-exchange disclosure | eMudhra shares fall about 20% in Mumbai on 21 October |
| 22 Oct 2026 | eMudhra's board votes to voluntarily exit the global SSL/TLS business | Customers to be moved to Sectigo-issued replacements free of charge |
| 27 Oct 2026 | Chrome removes the emSign ECC Root CA – G3 from its root store | Any site still chaining to that root breaks in Chrome until it migrates |
Image: Unsplash (free Unsplash licence) — Illustrative image: digital code, representing the cryptographic keys at the heart of the incident
Why it matters for India readers
For Indian readers, the most important line in this story is the one separating eMudhra's two businesses. The business being wound down is the international website-certificate arm, which sold trust to the global web. The Indian regulated business — Digital Signature Certificates and eSign, supervised by the Controller of Certifying Authorities on separate infrastructure — is untouched, and both eMudhra and the IT ministry have said so repeatedly. So the DSC you use for tax filings or company paperwork is not affected by this exit. What is affected is the global web of trust: about 30,800 unexpired certificates chained to the emSign ECC Root CA – G3 as of 21 October, of which 99.9% were issued through InCommon, the certificate service Internet2 runs for the higher-education community, which had moved onto eMudhra's CertiNext platform between April and July 2026. Google has told operators with certificates under that root that they "must immediately acquire and install a new TLS certificate from another PKI hierarchy included in the Chrome Root Store."
The exit also says something blunt about the economics of trust. Free certificate providers have hollowed out the paid market, validity periods keep shrinking, and compliance and data-sovereignty demands keep rising — so a business worth 1% of revenue was, in the board's judgement, no longer worth a global reputational fire. Co-founder Kaushik Srinivasan put it plainly: "Given the risk to the rest of the business and our obligations as a publicly listed company, the board felt it was prudent to withdraw from this business." Developers who run services on these certificates should also apply the runtime fixes covered in our Python 3.15.1 security update guide, which already removes trust in the compromised eMudhra certificates.
Should you care?
✅ Care now if you run a website or service on an emSign certificate — ⏳ ordinary users mainly need one update. If your certificate chains to the emSign ECC Root CA – G3, 27 October is a hard deadline: after Chrome's removal, visitors will hit warnings or failed connections until you migrate, and eMudhra's free Sectigo replacement is the fastest route. If you simply browse, keep your browser and phone updated — the blocks were pushed automatically — and treat any certificate warning as a stop sign. Do not panic about DSC or eSign: on everything published so far, they are a different system entirely, and they are staying.
FAQs
Why is eMudhra exiting the SSL/TLS certificate business?
eMudhra's board voted on 22 October 2026 to voluntarily withdraw after researchers recovered the private keys of eight of its intermediate CAs, prompting Google and Mozilla to distrust its certificates. The company also cited rising compliance costs, data-sovereignty requirements, competition from free certificate providers and shrinking returns — global SSL/TLS contributes only about 1% of its revenue.
What happens to existing eMudhra certificate customers?
eMudhra says it will contact affected customers and replace their certificates free of charge with Sectigo-issued certificates. Its separate G1 RSA root hierarchy continues to serve customers in the meantime, and revocation and certificate-status services will run until every issued certificate has expired or been replaced.
Are eMudhra's digital signature and eSign services ending too?
No. eMudhra says its Indian digital signature certificate, eSign and CertiNext platform businesses continue, and both the company and the IT ministry say those services run on separate infrastructure from the global TLS business and are completely unaffected.
What should website owners do before Chrome removes the eMudhra root on October 27?
Check whether your certificate chains to emSign ECC Root CA – G3 or to any of the eight compromised intermediates, and if so replace it before 27 October 2026 — eMudhra's free Sectigo replacement is one route, or obtain a certificate from any hierarchy in the Chrome Root Store. Also update servers' trust stores and monitor Certificate Transparency logs for your domains.
TAKEAWAY
A trust business just decided trust was no longer worth selling: weak keys cost eMudhra its browser standing, and the board chose exit over repair. Customers get free replacements; the 27 October Chrome deadline still stands.
Follow India Tech on TechByCountry for the next hourly update.
📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.
Sources
YourStory — eMudhra to exit global website security certificate business (22 Oct 2026) • Inc42 — eMudhra to exit certificate business as security flaw triggers distrust (22 Oct 2026) • The Hacker News — eMudhra to exit global SSL/TLS business after 8 intermediate CA keys found easily guessable (22 Oct 2026) • CSO Online — eMudhra quits global TLS certificate market after compromise of CA signing keys (22 Oct 2026). Checked 25 Oct 2026.
Comments
Post a Comment