eMudhra Exits Global SSL/TLS Business After Security Issue; What Happened?
Add Preferred News Source
eMudhra’s board has decided to exit the global SSL/TLS certificate business after weak private keys were found in eight intermediate certificates. The company said its Indian DSC and eSign businesses remain unaffected.
Digital trust services provider eMudhra on Thursday, October 22, said its board has decided to exit the global SSL/TLS certificate business after a security issue involving eight intermediate certificates.
The business accounts for around 1% of eMudhra’s revenue. The company said its core enterprise solutions and other digital trust services, including its Digital Signature Certificate (DSC) and eSign businesses in India, remain unaffected.
The decision comes after weak private keys were discovered in eight intermediate certificates used in eMudhra’s global public trust infrastructure. The issue was reported by an independent security researcher on October 17, following which major browser companies moved to block the affected certificates.
eMudhra said there was no breach of its infrastructure or data. It also said the affected certificate authorities had not issued certificates to end users.
eMudhra Exits The SSL/TLS Business
eMudhra said its board decided to voluntarily withdraw from the global SSL/TLS certificate business after considering the recent security incident as well as the commercial viability of the segment.
The company cited rising compliance costs, operational complexity and increasing data-sovereignty requirements. It also said the availability of free SSL/TLS certificates from large providers has reduced the commercial potential of the business.
The security issue involved certificates created during a key-generation process in April 2025. According to CERT-In, the private keys were generated with insufficient randomness, making them vulnerable to recovery.
eMudhra revoked the eight affected intermediate certificates on October 18. Google and Mozilla also took steps to block the affected certificates from their browsers.
The company said it responded to the issue within hours of discovering it and has been working with browser programmes and customers as part of the transition.
What Happens To eMudhra’s Other Businesses?
eMudhra’s exit is limited to its global SSL/TLS certificate business, which contributes around 1% of its revenue.
Its Indian DSC and eSign services are not affected by the incident. The company said these businesses operate on separate infrastructure under India’s regulatory framework.
Enterprise public key infrastructure, electronic signature and identity authentication services will also continue as usual.
For customers affected by the SSL/TLS exit, eMudhra said it will coordinate with browser programmes and customers to provide replacement certificates through partners. Certificate revocation and status services will remain operational until existing certificates expire or are replaced.
The company will now focus on its enterprise solutions and digital trust services outside the global SSL/TLS certificate business.
Also Read - Gold Loans Jump 83% To ₹5.6 Lakh Crore As Bajaj Finance, Piramal Flag Repayment Stress
This article is for informational purposes only and should not be considered investment advice from Kotak Neo. For compliance T&C and disclaimers, Visit www.kotakneo.com/disclaimer
Rochelle Britto has spent 8+ years decoding India's markets, businesses, and consumer economy, reporting for ET Prime and Times Internet along the way, covering the stories behind the numbers.
A Mumbai native and perpetual planner of the next holiday, she stays far, far away from the eternal question, “Where are we going next?” When she's not chasing headlines, she's chasing new cultures, open roads, and a bit of quiet in nature.
Right Tools, Rich Insights
