eMudhra to exit global HTTPS certificate business after weak certificate keys found
Indian digital security company eMudhra has decided to exit the global SSL/TLS certificate business following a serious security incident involving eight digital certificates. The Bengaluru-based company’s board approved the decision on Thursday, October 22, after researchers discovered weaknesses that could allow attackers to create fake security certificates and impersonate legitimate websites. The incident prompted Google, Mozilla and other major technology companies to take protective action.
The development comes just days after the security flaw raised concerns over the safety of HTTPS connections. eMudhra maintains that its systems were not hacked and no customer data was stolen. The company says the affected business contributes only around 1 per cent of its total revenue. However, the incident has raised questions about the reliability of its certificate infrastructure.
Why is eMudhra exiting the SSL/TLS certificate business?
The controversy began when an independent researcher discovered that eight intermediate certificates issued by eMudhra had unusually weak private keys.
These certificates are part of the system browsers use to verify websites. The weakness could have allowed attackers to create fraudulent HTTPS certificates and impersonate genuine websites.
According to eMudhra, the problem originated during a certificate key-generation process in April 2025. The company revoked the affected certificates and began investigating the cause.
Related:
Centre orders investigation into eMudhra security incident
The Central government on Wednesday, October 21, took serious note of the incident involving eMudhra’s Public Key Infrastructure (PKI).
The Ministry of Electronics and Information Technology (MeitY) formed a special team to investigate the matter.
CERT-In issued a security advisory outlining the risks and necessary protective measures. The government said the impact on Indian websites and applications had been limited.
Related:
Will eMudhra’s digital signature services in India be affected?
eMudhra has clarified that its Indian Digital Signature Certificate (DSC) and eSign services remain unaffected.
These services operate on separate infrastructure and will continue normally.
The company is working with affected customers to replace certificates and prevent service disruptions.
The decision to exit the global certificate business marks a significant development for eMudhra, which now faces the task of addressing the incident’s potential reputational impact.