India’s eMudhra Limited has announced it will exit the global SSL/TLS certificate business following the revelation of weak private keys in eight of its intermediate Certification Authority (CA) certificates. This decision was approved by its board on October 22, 2026, after emergency browser distrust measures and intensified concerns over the company’s controls for issuing certificates. The firm stated that its other digital trust services will continue unaffected.
Root Cause: Weakness in Key Generation
The problem stemmed from private keys generated during a key-generation ceremony on April 30, 2025. A flawed script in the key wrap/unwrap process created a second, weak set of P-384 elliptic-curve private keys. These were unintentionally used in certificate signing requests due to confusion caused by duplicated key labels. Because these weak keys had values under 256, they could be recovered almost immediately from their public keys. Six of the affected certificates were used for TLS, while two were for code signing. eMudhra’s infrastructure was not compromised, and no data was breached, according to the company.
Urgent Response and Industry Fallout
After a researcher reported proof of control over the weak private keys on October 17, Mozilla confirmed the flaw and raised the alarm. Browsers including Google Chrome and Mozilla Firefox blocked the affected TLS certificates the same day. In addition, browsers began distrusting eMudhra’s ECC Root CA – G3 to protect clients that may not receive or enforce intermediate certificate revocation information. Some of these root store changes were projected to propagate to relevant devices by October 27.
The number of certificates needing migration is roughly 30,000, although none of these are from the eight flawed intermediates. eMudhra made clear that those certificates don’t include end-entity certificates (used by websites or publishers), and that no confirmed exploitation had been reported as of October 21.
Strategic and Financial Implications
The global SSL/TLS segment contributed about 1% of eMudhra’s total revenue. Growing pressure from data sovereignty, regulatory compliance costs, and competition from free certificate issuers had already been squeezing margins. These strains, combined with the fallout over the weak-key incident, led leadership to conclude the business is not viable to continue.
Moving forward, eMudhra plans to keep its G1 RSA root roots in service during a transition and will provide free replacement certificates via partners. Revocation and certificate status tools will remain operational until existing certificates are replaced or expire, and the company will fulfill browser-program obligations including a full root-cause report. In addition, CERT-In (India’s Computer Emergency Response Team) is advising administrators globally to update trust stores, audit certificate chains, and replace any affected certificates, especially where browser updates might not cover all systems.
This abrupt exit from SSL/TLS certificate issuance is a wake-up call for the entire certificate authority ecosystem. It underscores how fragile trust is in this infrastructure and how quickly key-generation flaws and oversight failure can reverberate. As organizations work to replace certificates, it will be crucial to watch whether regulatory scrutiny or demands for stronger CA audit standards follow. What counts now is not just remediation, but restoring confidence.
