Indian digital-trust company eMudhra has decided to withdraw from the global SSL/TLS certificate business following a security failure involving cryptographically weak intermediate certificate-authority keys. Major browser and operating-system providers moved to distrust affected certificates after researchers demonstrated that some private keys could be reconstructed using information available in public certificates.
The incident affected the system used by eMudhra’s international certificate operation, which issued certificates through the emSign brand. SSL/TLS certificates underpin encrypted website connections by confirming the identity of a domain and enabling browsers to establish a secure session. Compromise of a certificate-authority key can allow fraudulent certificates to be created, potentially enabling website impersonation or interception of supposedly encrypted communications.
Google, Apple, Microsoft and Mozilla responded by blocking or distrusting the affected certificate chains. eMudhra subsequently announced that it would close the global SSL/TLS operation and concentrate on its enterprise digital-trust portfolio and trust services outside this segment.
The company said the discontinued business accounted for approximately 1% of its revenue. Its Indian digital signature certificate, eSign and other enterprise services operate on separate infrastructure and will continue, according to the company. eMudhra is also working with customers that require certificate replacements or migration support.
The underlying problem was not described as a theft of private keys from eMudhra’s network. Instead, the affected keys were generated with values that were too small and predictable to provide the expected level of cryptographic protection. The weakness reportedly affected eight intermediate certificate-authority keys generated during a key ceremony in April 2025.
The incident illustrates the operational consequences of a failure at the certificate-authority level. Browser vendors can revoke trust in an affected chain, forcing customers to replace certificates rapidly to prevent warnings or service disruption. eMudhra’s exit removes the compromised international operation while preserving its separately operated Indian trust services, although customers and platform providers will continue remediation work around the affected certificates.
