eMudhra Ltd has decided to exit its global SSL/TLS certificate business following a security incident involving weak private keys in eight intermediate certificate authorities. The company's board took the decision on Thursday, October 22, as the incident drew scrutiny from browser providers and the government.
Shares of eMudhra fell nearly 20% on Thursday, hitting a 52-week low, amid concerns over the security incident. The stock has declined sharply over the past two trading sessions.
Shares of eMudhra plunged nearly 20% for the second consecutive session on Thursday, taking their two-session losses to around 36% following the disclosure of a security flaw involving eight intermediate certificates used in its global SSL/TLS business
The development follows a probe initiated by the Ministry of Electronics and Information Technology (MeitY), which has constituted a special team to investigate the incident. The Indian Computer Emergency Response Team (CERT-In) has also issued an advisory on the compromise of the certificates.
What went wrong?
The incident relates to a key-generation ceremony conducted on April 30, 2025, which resulted in weak private keys being generated for eight intermediate certificate authorities used in eMudhra's global website-security business.
In a statement issued on October 21, eMudhra said, “A flaw in the key generation ceremony caused a wrap / unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to the browser root stores.”
The affected keys could potentially be used to create fraudulent certificates and impersonate legitimate websites. Google and Mozilla have blocked the affected certificates in their browsers.
Chairman V. Srinivasan said eMudhra revoked the affected certificate authorities within 14 hours of discovering the issue. He said there were no end-entity certificates issued by the affected authorities.
“Its infrastructure was not compromised, no data was breached. All physical and logical security controls remained intact,” the company said in its October 22 press release.
Business contributes 1% of revenue
Explaining the decision to exit the business, eMudhra said global SSL/TLS certificates contribute around 1% of its global revenue. The company cited rising compliance requirements, operating costs and competition from providers offering certificates free of cost.
Srinivasan said, “Due to increasing data sovereignty & compliance requirements, complexity and cost associated with this business is increasing over the years.”
The chairman also pointed to the scrutiny generated by the incident, saying, “the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business”.
He added, “For many certifying authorities, SSL/TLS is the whole business. For eMudhra it is one part of a much broader digital solutions portfolio.”
The company said its board had concluded that “withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders”. It will now focus on core enterprise solutions and trust services outside the SSL/TLS business.
Customer transition and other businesses
eMudhra said its existing G1 RSA roots would continue serving customers until the transition is complete. It will work with browser programmes and affected customers to replace certificates free of cost through partners.
Revocation and certificate-status services will continue until every issued certificate has expired or been replaced. The company also said it would complete its remaining commitments to browser root programmes, including submitting a full root-cause report.
The company's other operations remain unaffected. These include digital signature certificates, eSign services in India, enterprise public key infrastructure solutions, its emSigner eSignature Suite and identity and authentication products.
eMudhra said its global SSL/TLS infrastructure operates separately from these businesses, which will continue to function as usual.