Indian digital security company eMudhra will withdraw from the global SSL/TLS certificate business following a security incident involving eight intermediate certificate authorities. The company’s board announced the decision on October 22, 2026, after the discovery of weak cryptographic keys raised concerns about website security.
The incident prompted major browser companies to distrust affected certificates. It also placed renewed attention on the systems that help users establish secure connections with websites.
However, eMudhra says its Indian digital signature and eSign services remain unaffected. The company plans to focus on its broader enterprise security and digital trust businesses.
What happened in the eMudhra security incident?
The eMudhra security certificate incident came to light on October 17, when an independent security researcher reported weaknesses in the cryptographic keys associated with eight intermediate certificate authorities.
The eMudhra security certificate incident highlights the importance of strong cryptographic keys and reliable certificate authority security.
These authorities formed part of eMudhra’s global Transport Layer Security infrastructure. The company subsequently revoked the affected authorities on October 18.
In a statement published on October 21, eMudhra explained that a flaw in its key-generation process had produced a second set of weak keys alongside the original, stronger keys. The weak keys were published to browser trust stores.
The company said its infrastructure had not been compromised and no data had been breached. It also stated that the affected authorities had not issued certificates to individual websites or end users.
Despite these assurances, the incident triggered action from major technology companies responsible for maintaining browser trust programmes.
Why SSL/TLS certificates matter
SSL/TLS certificates help browsers verify website identities and establish encrypted connections between users and web servers. They play an important role in protecting information exchanged during online activities.
For example, websites use these certificates when handling account logins, payments and other sensitive information. Browsers rely on trusted certificate authorities to help establish whether a website’s certificate is legitimate.
Intermediate certificate authorities sit within a larger trust hierarchy. If an intermediate authority becomes untrustworthy, attackers could potentially exploit its credentials to issue fraudulent certificates.
That possibility makes the security of cryptographic keys particularly important. Weak keys can undermine the trust that browsers and users place in digital certificates.
In eMudhra’s case, the incident raised concerns about the affected certificate authorities and the reliability of the processes used to generate their keys.
Google, Apple and Microsoft respond
The discovery led major browser and technology companies to take action against affected certificates. Google, Apple, Microsoft and Mozilla were among the organisations involved in the response.
Browser trust programmes determine which certificate authorities their products recognise. When a certificate authority no longer meets the required trust conditions, browser providers can remove or restrict that trust.
This process helps limit the risk associated with compromised or unreliable certificates. It can also force affected service providers to replace certificates and move customers to alternative trusted authorities.
For businesses using affected certificate infrastructure, the transition may require coordination with certificate providers and technology partners. Organisations must ensure that replacement certificates work correctly before existing trust arrangements end.
Why eMudhra is leaving the global market
eMudhra cited rising compliance requirements, operational complexity and increasing costs when explaining its decision to exit the global SSL/TLS certificate business.
The company also pointed to competition from providers that offer website certificates free of charge. These market conditions have reduced the commercial appeal of the business.
According to eMudhra, global SSL/TLS services contribute approximately 1% of its overall revenue. The company said the scrutiny surrounding the incident had also become disproportionate to the segment’s contribution to its wider operations.
Following its review, the board decided that withdrawing from the business was the right course of action.
The move marks a strategic shift for the company as it redirects resources towards enterprise solutions and other digital trust services.
Will eMudhra’s Indian services be affected?
eMudhra has stressed that its withdrawal applies to its global SSL/TLS certificate business, not its entire digital security portfolio.
The company said its Indian Digital Signature Certificate services, eSign operations, enterprise public key infrastructure solutions and identity authentication products continue to operate normally.
It also said its global SSL/TLS infrastructure runs separately from these other operations.
For customers using affected global certificate services, eMudhra plans to coordinate with browser programmes and partners to facilitate replacement certificates at no cost. The company will continue certificate revocation and status services until issued certificates expire or replacements are completed.
It also intends to submit a full root-cause report as part of its remaining commitments to browser root programmes.
What the incident means for website security
The eMudhra incident highlights how weaknesses in cryptographic processes can affect trust across the internet. Digital certificates depend on secure key generation, careful handling and consistent oversight.
Even when a company reports no infrastructure compromise or data breach, weaknesses in certificate authority credentials can create serious security concerns. Browser providers must assess those risks to protect users and maintain reliable website authentication.
The incident also demonstrates why certificate authorities need robust testing and independent oversight. Organisations that depend on digital certificates should monitor provider announcements and replace affected certificates according to official guidance.
For eMudhra, the immediate priority is to manage the transition for customers while strengthening its focus on other services. For the wider industry, the episode reinforces the importance of maintaining trust in the infrastructure that supports secure online communication.
