eMudhra exits the global SSL/TLS certificate business after eight weak signing keys are found

Indian certificate authority eMudhra announced on October 22, 2026 that its board has decided to voluntarily withdraw from the global SSL/TLS certificate business. The decision came five days after a security researcher reported on October 17 that the private keys of eight of eMudhra's intermediate certificate authorities — the signing credentials that browsers use to verify a website's identity — could be recovered in under a second due to extremely weak cryptographic key generation.

Google Chrome and Mozilla Firefox blocked the affected certificates within hours of the October 17 report. Apple followed on October 19 and Microsoft on October 20. India's CERT-In issued an advisory on October 21, telling organizations to update their operating system trust stores and review active certificate chains. eMudhra says it revoked the eight certificates within 14 hours of discovery, that no end-entity certificates were issued from the affected authorities, that its infrastructure was not compromised, and that no data was breached. The company estimates roughly 30,000 customer certificates need to be replaced and says it will provide free replacements through partner certificate authorities.

eMudhra's domestic Indian digital signature, eSign, and enterprise PKI services are not affected by the exit. Organizations that currently hold eMudhra global SSL/TLS certificates — used to encrypt web traffic and verify site identity — should contact eMudhra to confirm their replacement timeline and verify that their browsers and operating systems have received the updated trust store changes that block the revoked certificates.