Summary: eMudhra’s board has decided to withdraw from its global SSL/TLS certificate business after a security incident involving private keys linked to eight intermediate certification-authority certificates. Google and Mozilla say the weak keys could enable forged HTTPS certificates, and browser trust stores have blocked the affected certificates. eMudhra says the segment accounts for about 1% of global revenue and that its Indian digital-signature, eSign and enterprise trust businesses remain unaffected. The company must still complete customer migration and root-cause reporting.
Indian digital-trust provider eMudhra is leaving the global market for website security certificates after a serious cryptographic failure undermined trust in a group of its intermediate certificate authorities. The decision, announced on October 22, follows actions by major browser security teams to block affected certificates after researchers demonstrated that the associated private keys could be recovered.
What Happened
Google’s Chrome Root Program said on October 20 that it received a report on October 17 concerning weak private keys associated with eight eMudhra subordinate certificate-authority certificates. Mozilla published a parallel account on October 20 and said it blocked the affected certificates in Firefox through its OneCRL mechanism. Mozilla’s public Bugzilla record identifies six TLS certificates and two code-signing certificates in the affected group.
Google said no TLS certificates chaining to the six affected TLS intermediates had been logged in Certificate Transparency before its blocking action. That limits what the public record shows about potential misuse; it does not erase the underlying key-generation failure. Google also said it was removing the emSign ECC Root CA – G3 from the Chrome Root Store, with the change expected to reach devices relying on that store on October 27, 2026, Pacific time. Some otherwise legitimate certificates chaining to that root may stop working in Chrome.
In its October 22 announcement, eMudhra said its board had decided to voluntarily withdraw from the global SSL/TLS certificate business. The company said the segment represents about 1% of global revenue, and that its core enterprise solutions, digital-signature certificates, eSign, enterprise PKI and identity-authentication services—including its Indian operations—remain unaffected. These are the company’s statements; the browser trust-store actions are documented separately by Google and Mozilla.
Why It Matters
SSL/TLS certificates help browsers verify that a website is communicating through a trusted identity. When an intermediate certificate authority’s private key is recoverable, it can create a route for fraudulent certificates to be issued for domains the issuer does not control. Browser vendors therefore treat certificate trust as a security control, not simply a supplier relationship.
The immediate business risk extends beyond eMudhra’s certificate revenue. Organisations using certificates that chain to the affected root may need to replace them before Google’s planned root-store change. Certificate replacement, testing and deployment can create operational work for website owners and IT teams, even when no fraudulent certificate use has been established.
Market Impact
eMudhra shares faced a sharp sell-off during the week. Reuters reported a decline of roughly 40% over two trading days, while other market reports on October 23 described continued losses over a different time window. The percentages differ by timestamp and reporting window, so they should not be treated as a single closing-price figure. The timing indicates a strong negative market reaction around the security disclosure and exit decision, but it does not by itself quantify the long-term financial effect.
The company has said the SSL/TLS segment contributes about 1% of global revenue. That revenue share is not a measure of potential reputational, remediation or customer-retention costs, which remain difficult to quantify from the public information available so far.
Industry Context
Publicly trusted certificate authorities depend on continuing acceptance by browser and operating-system trust programmes. Google’s October 20 notice says the Chrome Root Program is reviewing eMudhra’s remaining certificates and coordinating with other browser vendors and software maintainers. Mozilla’s response shows that browser operators can block affected intermediates without waiting for every user to install a full browser update, while additional trust-store changes can affect applications that rely on shared certificate stores.
What To Watch Next
- Root-store change: Google’s stated target for removing the emSign ECC Root CA – G3 from the Chrome Root Store is October 27, 2026, Pacific time.
- Customer migration: Website operators should check whether their active certificates chain to the affected root and arrange replacement certificates from a trusted PKI hierarchy where required.
- Root-cause report: eMudhra has said it will work with browser root programmes and submit a comprehensive report explaining the incident.
- Business transition: Watch for details on the timetable for winding down global SSL/TLS issuance and how affected customers will receive replacements and ongoing revocation/status support.
FAQs
Why is eMudhra leaving the global SSL/TLS certificate business?
eMudhra’s board announced the withdrawal after a security incident involving eight intermediate certificate-authority certificates whose private keys were found to be weak. The company also cited rising compliance costs, operational complexity and limited commercial viability. It says SSL/TLS contributes about 1% of global revenue, while its other digital-trust services continue.
Were fraudulent certificates confirmed to have been used?
Google said no TLS certificates chaining to the six affected TLS intermediates were logged in Certificate Transparency before its blocking action. That is an important mitigating fact, but it should not be described as proof that every possible form of misuse was impossible. Google and Mozilla acted because the weak keys created a serious ability to forge certificates.
Are all eMudhra services being shut down?
No. The announced withdrawal concerns eMudhra’s global SSL/TLS certificate business. The company says its digital-signature certificates, eSign, enterprise public-key infrastructure, electronic signatures, identity authentication and Indian operations remain unaffected. Customers should still follow any specific migration notice relevant to the certificate or trust chain they use.
What should a website operator do now?
Check the certificate chain for the website and identify whether it relies on emSign ECC Root CA – G3 or one of the affected intermediate certificates. If it does, follow Google’s and the certificate provider’s migration guidance and install a replacement from a trusted PKI hierarchy before the announced root-store change. Test all production endpoints after replacement.
Sources and Documents
- Google Chrome Security Team — affected eMudhra certificates and Chrome Root Store actions (October 20, 2026)
- Mozilla Security Blog — Firefox response (October 20, 2026)
- Mozilla Bugzilla — public incident record for the eight intermediate certificates
- Reuters — eMudhra’s decision and reported market reaction (October 22–23, 2026)
- eMudhra — official board decision and customer transition statement (October 22, 2026)
- Moneycontrol/ANI — company statement and transition details (October 22, 2026)
