eMudhra quits the global TLS certificate business after its CA key leak

eMudhra quits the global TLS certificate business after its CA key leak

22 October 2026: eMudhra, the Bengaluru digital trust company listed in Mumbai, says its board has decided to withdraw voluntarily from the global SSL/TLS certificate business, a week after the private keys of eight of its intermediate certificate authorities were exposed and browsers and runtimes began distrusting them. Customers holding its TLS certificates will be contacted and moved to partner certificate authorities at no cost.

Not yet independently verified. eMudhra gives no date by which customers must move or by which issuance from the G1 RSA roots ends, and does not name the partners that will replace certificates. We will update this when it can be confirmed, and remove this note.

Why the company is leaving

Chairman V. Srinivasan says in the company's statement that eMudhra revoked the affected authorities within 14 hours of discovery, that no end-entity certificates were issued from them, and that its infrastructure was not compromised and no data was breached. Global SSL/TLS, he says, brings in about 1% of the company's global revenue, and its cost has been rising with data sovereignty and compliance demands while large providers give certificates away free. The statement also blames "social media amplification" for scrutiny out of proportion to the business line, and says the board concluded that leaving was right for the company and its shareholders.

The trigger is the incident we reported on 20 October: the eight emSign issuing authorities were revoked for CA compromise, Sectigo revoked its cross-signs and Go began blocking chains through them. eMudhra's own statement of 21 October addresses the distrust of select global TLS intermediates and one root.

What happens to existing certificates

eMudhra says its G1 RSA roots will keep serving customers until the transition is complete, while it works with the browser root programmes. It will reach out to affected customers and replace any certificate free of charge through partners, and its revocation and status services will keep running until every certificate it issued has expired or been replaced. It also says it will meet its remaining commitments to the browser programmes, including a full root-cause report. Co-founder Kaushik Srinivasan told Inc42 that customers would move to other providers over the next three to four weeks; that timeframe is not in the company's statement.

Teams with eMudhra or emSign TLS certificates should not wait for the outreach. Listing every certificate from these issuers across load balancers, appliances and partner integrations, and planning reissue from another authority, removes the risk of a second wave of validation failures if the remaining roots are distrusted before the move is finished.

The rest of the business carries on

eMudhra says its global TLS infrastructure runs separately from its other operations, and that its digital signature certificates, eSign and other signing services in India, its enterprise PKI products emCA and CertiNext, the emSigner eSignature suite and its identity products SecurePass and emAS are unaffected. Those are the products most Indian enterprise buyers know it for. Its profile on TrustList covers the wider portfolio.

Sources

• eMudhra: eMudhra to Exit global SSL/TLS Certificate Business, 22 October 2026
• Inc42: eMudhra to exit certificate business as security flaw triggers distrust, 22 October 2026
• Business Today: eMudhra to exit global SSL/TLS certificate business after security incident, 22 October 2026