eMudhra to Exit Global SSL/TLS Certificate Business

Bengaluru-based eMudhra will exit its global SSL/TLS certificate business after a security incident prompted Google, Mozilla, and Apple to block affected certificates.

The company said on Thursday that its board decided to exit the business, which contributes around 1% of its global revenue, and focus on enterprise software and other digital trust services.

The decision follows the discovery of eight eMudhra certificate authorities with weak private keys that could potentially have allowed attackers to create fake website certificates and impersonate legitimate websites. 

The eight compromised private keys were the numbers—-4, 56, 66, 115, 155, 156, 230 and 237. 

A typical P-384 cryptographic private key is a randomly generated 384-bit number, offering roughly 2384, or 10115, possible values, which are nearly impossible to guess. 

The eMudhra keys, on the other hand, were recoverable in less than a second.

eMudhra said the problem originated in an error during a key-generation process in April 2025. The company said its infrastructure had not been compromised, no data had been breached, and the affected authorities had not issued certificates to end users. 

It revoked the affected authorities after discovering the issue and is investigating the root cause.

Google blocked the affected certificates in Chrome and extended protections to supported Android devices. Mozilla blocked them in Firefox, while Apple also introduced safeguards. 

India's Computer Emergency Response Team (CERT-In) issued an advisory, while the Ministry of Electronics and Information Technology said it had formed a special team to investigate the incident. 

The authorities have distinguished the affected international website-certificate business from eMudhra's domestic digital signature and eSign services, which remain operational.

eMudhra said it would provide replacement certificates to affected customers free of charge through partners. Its certificate-status and revocation services will continue until existing certificates expire or are replaced.

The company said rising compliance costs, competition from providers offering certificates free of charge and the scrutiny following the incident had contributed to its decision to exit the business. 

Its other operations, including enterprise identity management, electronic signatures and public key infrastructure products, are unaffected, it said.