eMudhra to exit global website security certificate business

eMudhra is withdrawing from issuing and operating global SSL/TLS certificates. These certificates help authenticate websites and secure communications between websites and users. They matter because browsers use them when deciding whether a website can be trusted. A failure in this system can expose users to impersonation risks.

The incident involved eight weak intermediate certificate authority keys linked to eMudhra. Such keys sit beneath trusted root certificates and can be used to issue certificates for websites. Google warned that attackers could use the weakness to forge trusted HTTPS certificates. However, eMudhra said none of the affected authorities had issued end-user certificates.

The company cited rising compliance costs, data-sovereignty demands, and declining returns. SSL/TLS contributes about 1% of eMudhra's global revenue. Its Indian digital-signature and eSign operations, enterprise PKI platforms, and identity services will continue normally. Existing customers will receive transition support while eMudhra works with browser programmes and partners.

The global SSL/TLS certificate business contributes approximately 1% of eMudhra's global revenue. That is a small portion of the company's overall business. The figure matters because exiting a limited revenue stream can reduce exposure without disrupting its larger operations. It also helps explain why the board described withdrawal as appropriate for the company and shareholders.

The business had become more expensive and complex to run. eMudhra cited rising compliance costs and increasing data-sovereignty requirements. It also faced competition from large providers offering SSL/TLS certificates free of cost. That pressure reduced the segment's commercial potential and return on investment.

The incident added scrutiny and operational obligations. eMudhra said it would focus resources on core enterprise solutions and digital trust services outside SSL/TLS. Its Indian digital-signature certificates, eSign services, enterprise platforms, and identity solutions are separate and will continue operating normally. The company has not specified an exit timeline.

The eight keys were intermediate certificate authority keys associated with eMudhra. Certificate authorities help establish whether website certificates can be trusted. Intermediate authorities operate within that trust structure. Because these keys were dangerously weak, they created a potential path for attackers to generate certificates that browsers might accept as legitimate.

The key mechanism was impersonation. Google warned that attackers could forge trusted HTTPS certificates using the weak keys. A forged certificate could make a fake website appear connected to a legitimate domain. The keys were generated in April 2025, yet the weakness remained undetected for about 18 months, according to the article. Mozilla and Google moved to block the affected certificates.

The reported risk did not become a confirmed breach of eMudhra's wider infrastructure. The company said its infrastructure was not compromised, no data was breached, and none of the affected intermediate authorities had issued end-user certificates. eMudhra revoked the affected certificate authorities within 14 hours of discovering the incident and disclosed it.

Browser blocking or certificate revocation changes whether browsers trust affected HTTPS connections. This protects users from certificates that could support website impersonation. It can also create disruption for website operators, because visitors may see warnings or fail to receive the normal trusted connection. The article does not list specific customer outages.

Google and Mozilla acted after the weak keys were discovered. Google warned that the keys could allow forged trusted HTTPS certificates, while Mozilla blocked the affected certificates in Firefox. In practical terms, website operators using affected certificates must replace them, and customers may need to update their deployments. The exact effect depends on which certificates were involved.

For eMudhra customers, the company said G1 RSA root certificates would continue serving customers during the transition. It will contact affected customers and arrange free replacement certificates through partners. Revocation and certificate-status services will continue until every issued certificate has expired or been replaced, while eMudhra completes its browser-programme obligations.

eMudhra plans a managed withdrawal rather than an immediate shutdown for existing customers. Its G1 RSA root certificates will continue serving customers during the transition. This gives customers time to move away from the global SSL/TLS business while eMudhra works with browser programmes and customers on the withdrawal.

Affected customers will be contacted directly. eMudhra said it would arrange replacement certificates free of cost through partners. The practical mechanism is certificate replacement: customers move their websites to new certificates while the old certificates are retired or allowed to expire. The article does not specify the partners or the detailed replacement schedule.

Revocation and certificate-status services will continue until every issued certificate has expired or been replaced. eMudhra also committed to remaining browser-programme obligations, including a full root-cause report. The company has not specified a timeline for completing its exit. Its separate Indian and enterprise services will continue normally.

Browser companies are central because their software decides whether website certificates are trusted. Google and Mozilla can therefore block certificates or remove trust from certificates that present security risks. Their actions affect users of Chrome and Firefox directly. This response helps prevent browsers from accepting certificates that might enable website impersonation.

In this case, Google's Chrome Security team warned that the weak keys could allow forged trusted HTTPS certificates. Mozilla blocked the affected certificates in Firefox. CERT-In, India's Computer Emergency Response Team, issued an advisory on October 21, flagging risks linked to the compromised certificate keys. These actions communicate risk and reduce exposure.

The article does not explain the organisations' legal authority in detail. In practice, browser providers control trust decisions in their products, while CERT-In provides national cybersecurity guidance. eMudhra also had obligations to browser root programmes and promised a full root-cause report. Together, these responses show why certificate failures receive attention beyond the provider itself.

Public key infrastructure, or PKI, creates a trust chain for HTTPS. A certificate authority validates a website and signs a certificate containing its identity and public key. The browser checks that signature against trusted root certificates. If the checks succeed, the browser can treat the website's certificate as trusted and establish secure communication.

Cryptographic keys are central because they create and verify those signatures. In the incident, eight weak intermediate certificate authority keys linked to eMudhra could potentially have let attackers forge trusted HTTPS certificates. A forged certificate could help an attacker impersonate a legitimate website. eMudhra said none of the affected authorities had issued end-user certificates.

The article does not explain PKI mechanics in detail; this is the standard model behind HTTPS. Google and Mozilla blocked affected certificates, while eMudhra revoked the certificate authorities within 14 hours of discovery. The company will continue status services during the transition and submit a root-cause report to browser programmes.