Bengaluru-based digital trust company eMudhra has decided to exit its global SSL/TLS certificate business following a security incident involving weak cryptographic keys that prompted action from Google and Mozilla. In a regulatory filing on Thursday, the company said its board had decided to voluntarily withdraw from the business, citing rising compliance costs, increasing data sovereignty requirements and diminishing commercial returns. The decision follows the discovery of eight intermediate certificate authority keys linked to eMudhra that were found to be dangerously weak, potentially allowing attackers to impersonate legitimate websites. The keys were generated in April 2025, but the weakness remained undetected for about 18 months. Google and Mozilla subsequently moved to block the affected certificates to protect users. eMudhra Chairman V Srinivasan said the company had revoked the affected certificate authorities within 14 hours of discovering the incident and promptly disclosed the issue.
The company maintained that its infrastructure had not been compromised, no data had been breached and none of the affected intermediate authorities had issued end-user certificates.
Global SSL/TLS certificates, which help authenticate websites and secure online communications, contribute approximately 1% of eMudhra's global revenue.
Srinivasan said increasing data sovereignty and compliance requirements had made the business more complex and expensive to operate. Competition from large providers offering SSL/TLS certificates free of cost had also reduced its commercial potential and return on investment.
"The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS's place in our business," Srinivasan said.
He added that the board, following detailed deliberations, had concluded that withdrawing from the global SSL/TLS business was the right decision for the company and its shareholders.
eMudhra said it would now sharpen its focus on core enterprise solutions and digital trust services outside the SSL/TLS segment.
What happens to existing customers?
The company said its G1 RSA root certificates would continue to serve customers during the transition as it works with browser programmes and customers to facilitate the withdrawal.
It will reach out to affected customers and arrange replacement certificates free of cost through partners.
Revocation and certificate status services will continue until every issued certificate has expired or been replaced.
eMudhra also committed to fulfilling its remaining obligations to browser root programmes, including submitting a full root-cause report on the incident. It has not specified a timeline for completing the exit.
Other operations unaffected
The company clarified that its global SSL/TLS infrastructure operates separately from its other businesses, including its Indian digital signature certificate (DSC) and eSign services. Its enterprise public key infrastructure platforms, including emCA and CertiNext, emSigner eSignature Suite and identity and authentication solutions such as SecurePass and emAS, will also continue operating normally. The incident has drawn scrutiny from global browser providers and Indian authorities. Google's Chrome Security team had warned that the weak keys could allow attackers to forge trusted HTTPS certificates, while Mozilla blocked the affected certificates in Firefox.
India's Computer Emergency Response Team (CERT-In) also issued an advisory on October 21, flagging the risks associated with the compromised certificate keys.
eMudhra, which provides digital identity, trust and security solutions across more than 35 countries, said the decision would allow it to concentrate resources on its broader enterprise technology portfolio.