eMudhra to Exit Global Certificate Business After Security Lapse

Indian cybersecurity company eMudhra has announced that it will shut down its global digital certificate business following a major security lapse that prompted leading technology companies to block compromised certificates and raised concerns about Internet Security worldwide. The Bengaluru-based company announced the decision on Thursday, October 22, citing rising compliance requirements, increasing operational complexity, data sovereignty concerns and mounting costs associated with its global Secure Sockets Layer (SSL) and Transport Layer Security (TLS) certificate operations.

The decision comes after eMudhra confirmed that private cryptographic keys associated with eight intermediate certificates had been compromised. The disclosure triggered a coordinated response from major browser developers, including Google, Apple, Microsoft and Mozilla, which moved to block the affected certificates to reduce the risk of misuse.

The compromised keys raised concerns because they could potentially be used to issue fraudulent digital certificates for internet domains. Such certificates could undermine the trust that browsers place in secure connections and create opportunities for attackers to impersonate legitimate websites.

Although eMudhra has said there is no evidence that its infrastructure was compromised or that data was breached, the incident has damaged confidence in its global SSL/TLS business. The company’s shares, which are listed on Indian stock exchanges, fell 40 per cent over the two days after the vulnerability was disclosed.

eMudhra has also acknowledged that the public reaction to the incident has intensified scrutiny of its international operations. However, the company maintains that the global certificate business contributes only around one per cent of its global revenue and has become less profitable as major providers offer SSL/TLS certificates for free.

Why Is eMudhra Shutting Down Its Global Digital Certificate Business?

eMudhra has attributed its decision to a combination of operational, financial and reputational challenges affecting its global SSL/TLS certificate business.

According to the company, increasingly demanding data sovereignty requirements and compliance obligations have made the business more complicated to operate. Rising costs and the complexity of maintaining a global certificate infrastructure have also contributed to the decision.

The company further pointed to the impact of what it described as the excessive amplification of the recent security incident on social media. According to eMudhra, the resulting scrutiny of its global operations was out of proportion to the incident and its reported impact.

Competition has also affected the commercial viability of the business. SSL/TLS certificates are essential to securing website connections, but several major providers offer them without charge. This has reduced the scope for companies to generate revenue from certificate issuance alone.

eMudhra had previously stated that its global SSL/TLS service accounts for approximately one per cent of its global revenue. The relatively small contribution, combined with increasing operating costs and reputational challenges, has influenced its decision to exit the segment.

The announcement does not mean that eMudhra is shutting down all its digital security operations. The company has clarified that its Indian digital signature certificate services, eSign platform and other signing services will continue operating normally.

What Happened in the eMudhra Security Incident?

The security incident centres on the compromise of weak private cryptographic keys associated with eight intermediate digital certificates used in eMudhra’s global certificate operations.

On Wednesday, October 21, the company publicly confirmed that the private keys linked to the eight intermediate certificates had been compromised. The issue had first been reported by an independent security researcher identified as Wayne, who reverse-engineered the certificates and uncovered the private keys, potentially with the assistance of artificial intelligence techniques.

The discovery raised serious concerns because the affected keys were connected to a certificate authority trusted by major browsers and other internet infrastructure providers.

Digital certificates are used to establish that a website is associated with the domain it claims to represent. When a browser connects to a website using HTTPS, certificates help authenticate the website and support the encrypted connection between the user’s device and the server.

If an attacker obtains the private key associated with a trusted intermediate certificate, that key could potentially be used to issue fraudulent certificates for other domains. Depending on the certificate’s scope and how widely it is trusted, this could undermine the security assumptions that protect users when they access websites.

The compromised eMudhra keys therefore represented a broader internet security concern, even though the company said it had found no evidence of a data breach or infrastructure compromise.

Why Were Google, Apple, Microsoft and Mozilla Involved?

Major browser developers moved to block the compromised intermediate certificates after the vulnerability came to light. Google, Apple, Microsoft and Mozilla were among the companies that responded to the incident.

Browsers maintain lists of trusted certificate authorities and use certificate validation systems to determine whether a website’s digital certificate can be trusted. When a certificate authority or an intermediate certificate is considered unsafe, browser developers can update their trust systems to prevent the affected certificates from being accepted.

In eMudhra’s case, blocking the compromised intermediate certificates was intended to reduce the possibility that they could be used to issue fraudulent certificates that browsers would otherwise trust.

The response extended beyond browser companies. Operating system vendors, web infrastructure providers such as Cloudflare, application developers and security teams also took steps to distribute updates and issue advisories.

The involvement of these organisations reflects the interconnected nature of internet security. Certificate authorities, browsers, operating systems and websites all depend on a shared system of trust. A weakness in one part of that system can require coordinated action from multiple organisations.

The speed of the response was particularly important because the compromised keys could potentially have been used to create certificates for domains trusted by millions of servers and internet users worldwide.

How SSL and TLS Certificates Protect Internet Users

SSL and TLS certificates play a central role in protecting data exchanged between users and websites. Although SSL is an older protocol and TLS is its successor, the terms SSL/TLS are commonly used to describe the certificates and systems that secure web connections.

When a user visits a website that uses HTTPS, the browser checks the site’s digital certificate as part of establishing a secure connection. The certificate helps verify the website’s identity and supports encryption, which protects information transmitted between the user’s device and the website’s server.

Such connections are important when users access online banking services, government portals, shopping websites, email platforms and other services that handle sensitive information.

A certificate authority, or CA, is an organisation that issues digital certificates and helps establish trust in website identities. Browsers and operating systems maintain trust relationships with recognised certificate authorities and use those relationships when validating certificates.

eMudhra operates as a certificate authority in the global digital security ecosystem. Its role includes issuing certificates used by browsers and other systems to authenticate websites.

The exposure of private keys associated with intermediate certificates is serious because these keys can potentially be used to create certificates beyond the authority originally intended for them. If such certificates are accepted by browsers, attackers could attempt to impersonate legitimate websites.

This is why certificate authorities must maintain strong cryptographic protections and why browsers respond quickly when the security of a certificate chain is called into question.

What Made the Compromised Private Keys a Serious Risk?

Private cryptographic keys are intended to remain secret. In digital certificate systems, they are used to sign certificates and establish the authenticity of information within a certificate chain.

According to the reported details of the eMudhra incident, the affected intermediate certificates were associated with weak private keys. The independent researcher who identified the problem reportedly reverse-engineered the certificates to uncover the keys, potentially using AI-assisted techniques.

Some of the recovered keys were reportedly so weak that they could be identified through cryptographic analysis. The source material notes that one of the keys was the number “4”, illustrating the severity of the weakness.

If someone had obtained and exploited the compromised keys before the affected certificates were blocked, they could potentially have issued fraudulent certificates for internet domains. Depending on the circumstances, such certificates might have been used to impersonate legitimate websites or facilitate attacks against users.

Security experts warned that the incident came close to creating a major internet security crisis. However, the available information does not establish that malicious actors used the compromised keys to intercept or decrypt encrypted web traffic.

The distinction is important: the exposure of a key creates the possibility of abuse, but it does not automatically establish that an attack took place. eMudhra has said it has no evidence of a data breach or compromise of its underlying infrastructure.

eMudhra Says It Revoked Affected Certificates Within 14 Hours

eMudhra chairman V Srinivasan said the company handled the incident diligently, revoked the affected certificate authorities within 14 hours of discovering the problem and disclosed the incident promptly.

He also said that no end-entity certificates had been issued by the affected certificate authorities. According to the chairman, the company’s infrastructure was not compromised, no data was breached, and its physical and logical security controls remained intact.

These statements form the company’s account of the incident and its immediate response. The broader implications of the compromised keys, however, prompted browser developers and other technology companies to take protective action.

Revoking affected certificates and blocking them through browser and operating system trust mechanisms are important steps in limiting the risk of misuse. However, a full understanding of how the weak keys were generated and why the weakness occurred requires a technical investigation.

eMudhra has said it will continue working with browser companies and publish a detailed root-cause report after completing its investigation.

The report is expected to provide further information about the underlying failure and the measures taken to address it. Until that investigation is complete, the full technical circumstances behind the incident remain subject to clarification.

eMudhra Faces Reputational Damage After Security Lapse

Beyond the immediate technical response, the incident has created a reputational challenge for eMudhra’s global certificate business. Certificate authorities depend on the confidence of browsers, operating systems, website operators and users that their certificates can be trusted.

Co-founder Kaushik Srinivasan acknowledged that the company needs to address the reputational impact of the incident in the short to medium term.

Speaking to The Indian Express, he said the company was actively reaching out to customers to explain the situation. He also argued that a similar incident could potentially happen to other certificate providers.

The company’s response highlights the importance of trust in the certificate authority business. Unlike a conventional technology service, a certificate authority operates within a security framework that depends on external organisations accepting its credentials.

When browser companies decide to block compromised certificates, the practical ability of those certificates to establish trust can be significantly reduced. Even if a company says it has contained the technical issue, restoring confidence can require additional communication, investigation and evidence that the problem has been addressed.

eMudhra’s decision to exit the global SSL/TLS segment comes against this backdrop. The company has cited business considerations as well as the scrutiny generated by the security incident, while acknowledging that its reputation in this particular business has been affected.

eMudhra Shares Fall 40% in Two Days

The security incident also had a significant impact on eMudhra’s stock market performance. Shares of the Bengaluru-based company fell 40 per cent over the two days after the vulnerability was disclosed, according to the supplied report.

The decline came as the company faced questions about the security lapse and announced its decision to shut down its global digital certificate business.

Investor concerns can arise when a security incident creates uncertainty about a company’s operations, customer relationships, regulatory exposure or future revenue. In eMudhra’s case, the company has said that the global SSL/TLS business contributes only around one per cent of its overall global revenue and has become less profitable.

That relatively small revenue contribution is one factor in the company’s decision to leave the segment. However, the stock decline followed the disclosure of the vulnerability and reflects the market reaction reported at the time.

The decision to close the global certificate business does not amount to a complete shutdown of eMudhra’s operations. Its domestic digital signature, eSign and other signing services are expected to continue operating normally, according to the company.

What Happens to Existing eMudhra SSL/TLS Certificates?

Although eMudhra is shutting down its global digital certificate business, the company has outlined a transition process for existing customers and certificates.

It said certificates issued under its RSA root, including the emSign Root CA – G1 and other certificates, will continue serving customers during a transition period.

The company has also said it will replace affected certificates free of cost through its partners during the transition. This measure is intended to support customers as they move away from the existing global SSL/TLS service.

In addition, eMudhra will continue maintaining Certificate Revocation Lists (CRLs) and other certificate-status services until every emSign SSL/TLS certificate has either expired or been replaced.

CRLs are lists used to identify certificates that have been revoked before their scheduled expiry. Certificate-status services help browsers and other systems determine whether a certificate remains valid or has been withdrawn.

Maintaining these services during the transition is important because certificates already deployed on websites and other systems cannot simply be ignored when a business exits the market. Customers need to know whether their certificates remain valid, whether replacement is required and how the transition will be managed.

The company has already stopped issuing certificates under the G3 chain, which included the compromised intermediate certificates.

Will Indian Government and Digital Signature Services Be Affected?

eMudhra has clarified that its Indian operations, including its digital signature certificate services and eSign platform, are not affected by the security incident and will continue operating normally.

The company is among the certificate authorities in India licensed by the Controller of Certifying Authorities (CCA), which operates under the Ministry of Electronics and Information Technology (MeitY).

Its domestic services include issuing web security certificates for government websites, including the Unique Identification Authority of India (UIDAI), which issues Aadhaar, and the income tax portal.

In addition to web security certificates, eMudhra provides digital document signing services, enterprise Public Key Infrastructure (PKI) solutions and other identity and authentication services.

These offerings support different functions from the global SSL/TLS certificate business that the company has decided to shut down. Digital signature certificates and eSign services are used to support electronic signing and authentication, while website certificates help browsers establish secure connections with online services.

The company has said that its global digital signature certificate services, eSign and other signing services, including those in India, are not affected and will continue as normal.

Co-founder Kaushik Srinivasan also said he did not expect the reputational fallout from the global certificate incident to extend to the company’s relationships with Indian government clients. He referred to government advisories issued after questions were put to the company and said those advisories indicated there had been no impact on the wider ecosystem.

Why the Incident Matters for Internet Security

The eMudhra incident highlights the importance of cryptographic security within the internet’s certificate trust system. Digital certificates help users establish secure connections, but that trust depends on the integrity of the keys and processes used by certificate authorities.

A weakness in a private key can create risks beyond the organisation that generated it because certificates issued through trusted chains may be accepted by browsers and other systems worldwide.

That is why the response involved browser developers, operating system vendors, web infrastructure companies, application developers and security teams. Coordinated action can help prevent compromised certificates from being used to establish trust with users’ devices.

The incident also demonstrates that the exposure of a cryptographic key can be serious even when there is no confirmed evidence of a successful attack. The possibility that an attacker could issue fraudulent certificates may be sufficient to trigger protective action across the internet ecosystem.

At the same time, it is important to distinguish between a vulnerability, the potential consequences of exploiting it and evidence that exploitation actually occurred. In this case, the supplied report says there is no clear evidence that the compromised keys were used by malicious actors to intercept and decrypt encrypted web traffic.

The investigation and forthcoming root-cause report will be important in explaining how the weakness occurred and what lessons can be drawn from the incident.

What Happens Next for eMudhra?

eMudhra’s immediate priorities include supporting customers through the transition, continuing to work with browser companies and completing its investigation into the security lapse.

The company has said it will publish a full root-cause report once the investigation is complete. The report should provide more clarity about the origin of the weak keys, the circumstances surrounding their exposure and the technical measures taken in response.

During the transition period, eMudhra has committed to maintaining certificate-status services and replacing certificates through its partners free of cost. These measures are intended to help existing customers move away from the global SSL/TLS business without losing access to information about certificate validity and revocation.

The company has also said that its Indian digital signature, eSign and other signing services will continue operating normally. Its exit from the global SSL/TLS segment therefore represents a decision affecting a specific part of its business rather than a complete withdrawal from digital identity and authentication services.

The long-term implications will depend on the findings of the investigation, the management of the certificate transition and the company’s ability to maintain confidence in the services that remain operational.

Conclusion

eMudhra has decided to shut down its global digital certificate business after a security lapse exposed weak private keys associated with eight intermediate certificates. The incident prompted Google, Apple, Microsoft and Mozilla to block the affected certificates and led to a broader response from technology and cybersecurity companies concerned about the potential misuse of the keys.

The company says it revoked the affected certificate authorities within 14 hours of discovering the issue, that its infrastructure was not compromised and that no data was breached. However, the incident has created a reputational challenge for its global SSL/TLS business, which contributes approximately one per cent of its global revenue. Its shares fell 40 per cent over the two days after the vulnerability was disclosed.

eMudhra will continue supporting existing customers during the transition, maintain certificate-status services until all relevant certificates expire or are replaced, and publish a root-cause report after completing its investigation. Meanwhile, the company has said its Indian digital signature certificates, eSign platform and other signing services remain unaffected and will continue operating normally.