eMudhra exits global SSL/TLS certificate business
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Indian digital trust firm eMudhra's board approved exiting the global SSL/TLS certificate business after eight intermediate certificates were found to have weak private keys.
The segment is about 1 per cent of revenue, so the move is more about scrutiny and compliance than money.
Background
eMudhra Limited is a Bengaluru-based, Mumbai-listed digital trust services company whose products include digital signature certificates and eSign services. In October 2026 an independent security researcher known as Wayne reported that the private keys of eight eMudhra intermediate certificates — six tied to website security and two to software signing — had been compromised. After the issue drew scrutiny on social media, the board chose to withdraw from the global SSL/TLS certificate business, which eMudhra says contributes around 1 per cent of global revenue. The company cites growing complexity, rising compliance costs and data sovereignty requirements as well as the incident.
How it unfolded
- Oct 17, 2026Security researcher Wayne reported that the private keys of eight eMudhra intermediate certificates had been compromised; the disclosure concerned weak private keys in eight intermediate certificate authorities.
- Oct 21, 2026eMudhra came under social media scrutiny over its global SSL/TLS certificate infrastructure.
- Oct 22, 2026eMudhra's board approved a voluntary withdrawal from the global SSL/TLS certificate business, announced via an exchange filing.
- Oct 22, 2026eMudhra said it revoked the affected certificate authorities within 14 hours of discovering the issue and disclosed it promptly, and that the SSL/TLS business is around 1 per cent of global revenue.
- Oct 22, 2026eMudhra said its Global Root RSA certificates would keep serving customers until the transition is complete, and that it would work with browser programmes and customers on migration and complete a full root-cause report.
Who’s saying what
- Official
- Chairman V. Srinivasan said social media attention brought scrutiny out of proportion to the segment's contribution, and the board concluded exiting was right for the company and shareholders.
- Official
- Srinivasan said the company handled the incident diligently, revoking affected certificate authorities within 14 hours and disclosing promptly, and that business potential and return on investment in the segment had declined considerably, partly because some large entities issue SSL/TLS certificates free.
- Company
- eMudhra said no end-entity certificates were issued by the affected CAs, its infrastructure was not compromised, no data was breached, and its DSC, eSign and other services remain unaffected.
Still unverified
Independent verification of eMudhra's claim that its infrastructure was not compromised is not available in the public record yet; no source reviewed says anyone forged a software-signing signature using the weak keys.