Indian digital trust company eMudhra has decided to exit its global SSL/TLS certificate business after a serious cryptographic failure led major browser companies to block or distrust certificates linked to the company.
The Bengaluru-based firm said the affected international business contributes only about 1% of its revenue.
Its Indian Digital Signature Certificate and eSign operations are not affected because they run on separate infrastructure and under a different regulatory framework.
The exit follows the discovery of eight intermediate certificate authorities whose private cryptographic keys were generated with extremely weak randomness.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Weak Keys Could Be Recovered Almost Instantly
The security failure involved cryptographic keys created during a key-generation exercise in April 2025.
According to CERT-In, the affected P-384 elliptic-curve private keys had values smaller than 256.
That made them dangerously predictable.
A private key is supposed to be secret and mathematically difficult to guess.
It is one of the foundations of the system browsers use to determine whether a website is genuine and whether encrypted communication can be trusted.
In this case, researchers found that the weak private keys could be derived almost immediately from publicly available information.
That meant anyone who obtained or reconstructed the keys could potentially create fraudulent certificates appearing to come from a trusted certificate authority.
Such certificates could theoretically be used to impersonate legitimate websites or intercept encrypted communications.
CERT-In said there is currently no confirmed evidence that the weak keys were actually exploited maliciously.
Google and Mozilla Moved Quickly to Block Certificates
Browser companies responded rapidly after the issue was reported.
Mozilla blocked six affected TLS intermediate certificates through its OneCRL revocation system on October 17.
It also released security updates for Firefox and removed the related emSign ECC Root CA – G3 certificate from its trust infrastructure.
Google also blocked the affected public keys through an emergency Chrome revocation update.
The company later moved to remove the related root certificate from the Chrome Root Store.
Apple and Microsoft have also taken action against the affected certificate chain.
These measures are significant because browser trust is essential for any certificate authority operating globally.
If browsers stop trusting a certificate authority, websites relying on certificates issued under that hierarchy can start displaying security warnings or fail to establish trusted HTTPS connections.
That can effectively destroy the commercial viability of the affected certificate business.
eMudhra Says No Customer Certificates Were Issued
eMudhra has said that none of the affected intermediate authorities issued end-user certificates.
Only one of the affected intermediate certificates had been deployed in production, according to the company.
It also said there was no breach of its broader infrastructure and that its root CA private keys were not compromised.
Google separately said it found no TLS certificates chaining to six of the affected intermediates in public Certificate Transparency logs before the certificates were blocked.
Certificate Transparency logs are public records that allow browsers and security researchers to track certificates issued for websites.
That finding reduces the likelihood that the compromised keys were used to issue legitimate-looking certificates before browser vendors intervened.
However, possession of an intermediate CA private key remains highly sensitive because it can allow an attacker to create certificates independently.
That is why browser companies treated the weakness as a serious trust failure even without evidence of active abuse.
Why Certificate Authorities Matter to Internet Security
SSL/TLS certificates are one of the basic building blocks of secure internet communication.
When a browser displays the padlock symbol or establishes an HTTPS connection, it relies on a chain of trust linking the website certificate back to a recognised certificate authority.
A certificate authority essentially confirms that a website or digital service is who it claims to be.
If a certificate authority’s private keys become predictable or compromised, that trust can break down.
An attacker could potentially create certificates for websites they do not control.
That could make phishing sites look legitimate or enable more sophisticated interception attacks.
For that reason, certificate authorities are expected to follow extremely strict procedures when generating and protecting cryptographic keys.
Even a single failure can affect thousands of organisations relying on the same trust hierarchy.
Indian eSign and Digital Signature Services Remain Separate
The Indian government has stressed that eMudhra’s domestic services are separate from the affected global certificate infrastructure.
Its Indian Digital Signature Certificate and eSign businesses are regulated by the Controller of Certifying Authorities under the Ministry of Electronics and Information Technology.
CERT-In said those systems use separate cryptographic keys and infrastructure.
They are therefore not affected by the global TLS incident.
This distinction is important because eMudhra is widely used in India for electronic signatures, business filings and digital authentication.
The company has also said it is working with customers who rely on the affected international certificate hierarchy to migrate them to replacement certificates.
The commercial impact of leaving the global TLS market may be limited because the business contributes only around 1% of revenue.
The reputational impact could be more significant.
Certificate businesses depend heavily on trust from browsers, operating-system vendors and enterprise customers.
Once that trust is removed, rebuilding it can be difficult.
What this means for you:
Ordinary users should keep browsers and operating systems updated and should never bypass certificate warnings. Businesses using eMudhra-linked TLS certificates should check whether their certificate chain depends on the affected root and replace it if necessary.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
