Indian digital trust company eMudhra has decided to exit its global website security certificate business following a serious cryptographic vulnerability that affected eight intermediate security certificates. The decision, announced on October 22, 2026, comes after major technology companies moved to block the affected certificates, raising concerns about the reliability of digital systems used to establish trust across the internet.
The Bengaluru-based company said its board had approved the withdrawal from the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business. However, its Indian digital signature and eSign services will continue operating normally.
What Went Wrong at eMudhra?
The security incident involved eight intermediate certificate authorities created during a key-generation process on April 30, 2025. A software flaw reportedly generated weak cryptographic keys alongside the intended strong keys, with the weaker keys subsequently appearing in certificates trusted by major browsers.
Cryptographic keys help secure digital communications and establish the authenticity of websites. If attackers obtain a certificate authority’s private key, they may be able to create fraudulent certificates and impersonate websites that users trust.
An independent cybersecurity researcher discovered the weakness in October 2026 and reported it to major technology companies, including Google, Apple, Microsoft and Mozilla.
The issue had reportedly remained undetected for around 18 months, despite earlier security audits. The incident has therefore raised questions about the effectiveness of key-generation procedures, testing and certificate authority oversight.
Could Hackers Have Impersonated Websites?
The vulnerability created the potential for attackers to misuse the affected keys to impersonate websites and undermine secure connections.
However, eMudhra has maintained that the affected certificate authorities did not issue certificates to individual websites or end users. The company also said its infrastructure had not been compromised and that no data breach had occurred.
Major browser and operating system providers moved to distrust the affected certificates to reduce the risk. Nevertheless, devices and software that do not receive regular security updates may require additional attention to ensure they no longer trust the compromised certificates.
The incident demonstrates why digital certificate security is critical: a weakness in a trusted certificate authority can have implications beyond the organisation that generated the certificates.
Why Is eMudhra Leaving the Business?
The global SSL/TLS certificate business contributes approximately 1% of eMudhra’s revenue. The company cited the security incident, rising compliance costs, operational complexity and declining commercial viability as factors behind its decision to withdraw.
The market has also become increasingly competitive, with several providers offering website security certificates at little or no cost. This has reduced the commercial attractiveness of the business.
eMudhra said it would focus on its core enterprise solutions and other digital trust services. It will coordinate with customers and browser programmes to facilitate certificate replacements and maintain relevant revocation and status services during the transition.
Are Indian Digital Signature and eSign Services Affected?
eMudhra has stated that its Indian digital signature certificate (DSC) and eSign operations are unaffected because they run on infrastructure separate from the global website certificate business.
Its enterprise solutions, identity authentication services and other digital trust offerings are also expected to continue operating.
The company has emphasised that the incident did not involve a general breach of its infrastructure or customer data. Authorities and technical investigators are nevertheless examining the circumstances surrounding the weakness.
Customers using affected global TLS certificates should follow replacement instructions and ensure their systems trust the updated certificates. Ordinary users should keep browsers and operating systems updated.
A Wider Warning for Internet Security
The eMudhra incident highlights the importance of secure cryptographic key generation, independent testing and continuous monitoring across the internet’s certificate infrastructure.
Digital certificates are a foundational component of online security, helping browsers establish whether a website is genuine and whether communications are encrypted. Even when a vulnerability affects a limited number of certificates, the consequences can extend across software ecosystems that rely on trust relationships.
For eMudhra, the immediate challenge is to complete its withdrawal responsibly while supporting affected customers. For the wider cybersecurity industry, the incident is a reminder that trust depends on robust technical controls, transparency and timely responses to vulnerabilities.
Summary
eMudhra will withdraw from its global SSL/TLS website certificate business after a key-generation flaw affected eight intermediate certificates. The weakness could have enabled website impersonation, prompting major technology companies to block the affected certificates. eMudhra says its infrastructure was not breached, no data was compromised and no end-user website certificates were issued using the weak keys. Its Indian digital signature and eSign services remain unaffected.
