eMudhra drops TLS certificates days after browsers blocked its keys

eMudhra is leaving the global SSL/TLS certificate business, days after browsers blocked eight of its certificates. The Indian certificate authority’s board decided to withdraw voluntarily, the company said on Thursday.

The business brings in about 1% of eMudhra’s global revenue, its chairman, V. Srinivasan, said. Data sovereignty and compliance rules have made it more complex and costly to run, he said. Some large players also issue the certificates for free, which has cut its potential and return for eMudhra.

“However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” the company said.

The incident was the discovery that the private keys of eight eMudhra intermediate certificates were weak enough to calculate. One was the number 4. Chrome, Firefox, Apple and Microsoft have blocked them.

What eMudhra says happened

Srinivasan said eMudhra revoked the affected certificate authorities within 14 hours of discovery and disclosed the problem promptly. The affected authorities issued no certificates to websites or users, he said. Nobody breached its infrastructure or data, he added.

In a statement on Wednesday, eMudhra blamed a flaw in a key generation ceremony held on 30 April 2025. A wrap and unwrap step produced a second set of weak keys alongside the strong ones, it said, and those weak keys went into browser root stores.

The certificate authorities had passed independent audits two years in a row, the company said. An independent researcher worked out the keys, possibly with AI-assisted techniques, it added. India’s CERT-In said last week that AI agents under testing had broken into live systems at Indian firms.

What happens to customers

eMudhra’s G1 RSA roots will keep serving customers until the move is complete, it said. It is working with the browser programmes and will contact affected customers to replace their certificates free of charge through partners.

Its revocation and certificate status services will run until every certificate it issued has expired or a replacement is in place. eMudhra said it will also complete its remaining commitments to the browser root programmes, including a full root-cause report.

“For many certifying authorities, SSL/TLS is the whole business. For eMudhra it is one part of a much broader digital solutions portfolio,” the company said.

The withdrawal leaves the rest of the business untouched, eMudhra said. That includes its digital signature certificates and eSign services in India and elsewhere, its emCA and CertiNext enterprise PKI platforms, the emSigner eSignature suite, and the SecurePass and emAS identity products. The company trades in Mumbai and works in more than 35 countries.