eMudhra quits the global TLS certificate business after weak CA key flaw

eMudhra quits the global TLS certificate business after weak CA key flaw

22 October 2026: eMudhra, the Bengaluru digital trust company listed in Mumbai, says its board has decided to withdraw voluntarily from the global SSL/TLS certificate business, a week after the private keys of eight of its intermediate certificate authorities were found to be recoverable and browsers and runtimes began distrusting them. Customers holding its TLS certificates will be contacted and moved to partner certificate authorities at no cost.

Not yet independently verified. eMudhra's own statement page gives the browser phase-out dates of 16 and 30 November 2026 and says the eight intermediates had weak keys from a script error. The root cause analysis and the independent review it has promised are not yet published. We will update this when it can be confirmed, and remove this note.

Update, 10 November 2026: eMudhra's incident page, last updated on 5 November, now gives dates. Chrome and Firefox will not trust G1-chained certificates issued after 16 November 2026 (the SCTNotAfter date), and Apple removes the G1 hierarchy on 30 November 2026. eMudhra says it has moved emSign TLS issuance to other providers and offers Sectigo certificates. Its leadership note says a researcher reported that the private keys of eight G3 intermediates could be recovered, and that a script error resulted in issuing certificate authorities with weak keys.

Why the company is leaving

Chairman V. Srinivasan says in the company's statement that eMudhra revoked the affected authorities within 14 hours of discovery, that no end-entity certificates were issued from them, and that its infrastructure was not compromised and no data was breached. Global SSL/TLS, he says, brings in about 1% of the company's global revenue, and its cost has been rising with data sovereignty and compliance demands while large providers give certificates away free. The statement also blames "social media amplification" for scrutiny out of proportion to the business line, and says the board concluded that leaving was right for the company and its shareholders.

The trigger is the incident we reported on 20 October: the eight emSign issuing authorities were revoked for CA compromise, Sectigo revoked its cross-signs and Go began blocking chains through them. eMudhra's own statement of 21 October addresses the distrust of select global TLS intermediates and one root.

What happens to existing certificates

eMudhra said on 21 October that its G1 RSA roots would keep serving customers until the transition is complete, while it works with the browser root programmes. It will reach out to affected customers and replace any certificate free of charge through partners, and its revocation and status services will keep running until every certificate it issued has expired or been replaced. It also says it will meet its remaining commitments to the browser programmes, including a full root-cause report. Co-founder Kaushik Srinivasan told Inc42 that customers would move to other providers over the next three to four weeks; that timeframe is not in the company's statement.

Teams with eMudhra or emSign TLS certificates should not wait for the outreach. Listing every certificate from these issuers across load balancers, appliances and partner integrations, and planning reissue from another authority, removes the risk of a second wave of validation failures if the remaining roots are distrusted before the move is finished.

The rest of the business carries on

eMudhra says its global TLS infrastructure runs separately from its other operations, and that its digital signature certificates, eSign and other signing services in India, its enterprise PKI products emCA and CertiNext, the emSigner eSignature suite and its identity products SecurePass and emAS are unaffected. Those are the products most Indian enterprise buyers know it for. Its profile on TrustList covers the wider portfolio.

Sources

• eMudhra: eMudhra to Exit global SSL/TLS Certificate Business, 22 October 2026
• Inc42: eMudhra to exit certificate business as security flaw triggers distrust, 22 October 2026
• Business Today: eMudhra to exit global SSL/TLS certificate business after security incident, 22 October 2026
• eMudhra: Certificate security incident, update 4, 22 October 2026
• eMudhra: certificate security incident (update 8), 5 November 2026