eMudhra Quits the Global Website Certificate Business After Weak Keys Led Google, Mozilla, Apple and Microsoft to Block It

eMudhra, one of India's leading providers of digital certificates and signatures, said on Thursday, October 22, that it would voluntarily withdraw from the global SSL/TLS certificate business, days after a security researcher exposed weaknesses in certificates it had issued.

The decision follows a rapid sequence of events. Over the weekend, an independent cybersecurity researcher found that several key certificates issued by eMudhra were weak and "vulnerable to attack," Reuters reported. On Wednesday, India's Computer Emergency Response Team (CERT-In) issued an advisory saying some of eMudhra's intermediate certificates had been compromised. Google, Mozilla, Apple and Microsoft, which control the world's major web browsers and operating systems, blocked digital certificates issued by the company.

eMudhra said on Wednesday that it had withdrawn eight certificates. It said its infrastructure had not been compromised and no data had been breached.

Why certificates matter

SSL/TLS certificates are the foundation of security on the internet. When a user visits a website with an address beginning "https," the browser checks a digital certificate to confirm that the site is genuine and to set up an encrypted connection. The padlock symbol in a browser's address bar depends on this system.

Certificates are issued by certificate authorities, which browser makers and operating system vendors trust. That trust is hierarchical: root certificates, held by the authority, sign intermediate certificates, which in turn sign the certificates used by individual websites. If an intermediate certificate is compromised or uses weak cryptographic keys, attackers could potentially forge certificates and impersonate websites, intercepting sensitive communications.

Because the entire system depends on trust, browser makers act quickly when they find problems. In recent years, Google and Mozilla have removed trust from several certificate authorities over compliance failures, including Entrust in 2024.

A small business, a big impact

In a follow-up statement on Thursday, eMudhra said the global SSL/TLS certificate business contributed just 1% of its revenue, according to Reuters. The company said the scrutiny the incident had drawn was out of proportion to the significance of the business line, citing rising compliance costs and declining returns from the unit.

Investors reacted sharply nonetheless. eMudhra's shares fell 40% in the two days after the vulnerability was disclosed, reflecting concern that the episode could damage its reputation in its core businesses.

That concern is understandable. eMudhra's broader business is built on trust. The company issues digital signature certificates, provides identity and authentication solutions, and offers technology for electronic signatures and document workflows. Its customers include Infosys and TCS, and it issues certificates to government agencies, including for some online public services such as India's income tax portal.

India's digital trust infrastructure

The episode has prompted wider questions about India's digital trust infrastructure. India has built one of the world's most extensive systems of digital public infrastructure, including the Aadhaar identity system, the Unified Payments Interface and DigiLocker, along with widespread use of digital signatures for tax filings, company registrations and government processes.

Certificate authorities in India operate under a licensing framework administered by the Controller of Certifying Authorities, under the Information Technology Act. Their certificates are used for a wide range of domestic applications, from e-filing to e-tendering.

The global SSL/TLS business is distinct from much of this domestic activity, since it depends on recognition by international browser and operating system vendors. But the incident highlights how a security lapse in one part of a company's operations can raise questions about others.

The security lesson

Cybersecurity experts say the incident underscores the importance of rigorous key generation and management practices for certificate authorities. Weak keys can result from flawed random number generation, poor implementation or inadequate controls, and they can be discovered by researchers scanning public certificate data.

The publicly visible nature of certificates, which are logged in Certificate Transparency databases, means that weaknesses can be identified by anyone with the right tools. That transparency is designed to strengthen the system by surfacing problems quickly, as happened in this case.

The incident came during a turbulent week for internet security, with other high-profile vulnerabilities and breaches affecting global technology companies.

What it means for customers

For organisations that used eMudhra's SSL/TLS certificates for their websites, the browser blocks mean they need to obtain replacement certificates from other providers to avoid security warnings for visitors. Certificate authorities typically help affected customers transition, and the process is relatively quick for most websites.

For users of eMudhra's other services, such as digital signature certificates for tax filings or e-tendering, the company has said its infrastructure was not compromised. Regulators and customers are likely to seek assurance that controls in those businesses are robust.

How the browser trust system works

Browser makers and operating system vendors maintain lists of trusted root certificate authorities, known as root stores. Inclusion in a root store is valuable, since it allows a certificate authority's certificates to be accepted automatically by billions of devices. To remain included, authorities must comply with strict technical and operational requirements set by the CA/Browser Forum, an industry body, and by each browser's own policies, and undergo regular audits.

When problems arise, browsers can take a range of actions, from requiring remediation to distrusting specific certificates or removing an authority entirely. Removal is a severe step that effectively ends an authority's ability to issue publicly trusted website certificates.

A blow to Indian ambitions

eMudhra had positioned itself as one of the few Indian companies with globally recognised certificate authority status, a credential that supported its international expansion. The company had expanded into markets in the Middle East, Africa, Europe and the United States, selling digital trust and identity solutions.

Exiting the global SSL/TLS business may limit some of those ambitions, though the company's broader identity and signature solutions do not depend in the same way on browser trust. How international customers respond to the episode will be important for its growth strategy.

What comes next

eMudhra's exit from the global SSL/TLS market removes the immediate source of the problem, but rebuilding confidence will take longer. Investors will watch for any impact on its core businesses, customer retention and regulatory reviews.

For India's technology industry, the episode is a reminder that ambitions to build globally trusted digital infrastructure depend on meeting the highest standards of security, where even small lapses can have outsized consequences. Rebuilding that trust will be the company's most important task.