eMudhra leaves certificate market after weak-key error
The Indian security provider is withdrawing from the global SSL and TLS market after browsers blocked certificates.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Indian digital-security provider eMudhra is voluntarily ending its global SSL and TLS certificate activities. The move follows a security incident in which eight intermediate certificate authorities were found to have weak private keys.
eMudhra announced its withdrawal on 22 October. The company says the certificate authorities involved have been revoked and that no end-user certificates were issued by any of the eight authorities. According to the company, there are no indications that the infrastructure was breached or that data was stolen.
The certificate authorities were part of the infrastructure browsers use to determine which websites are trusted. Google reported that the private keys contained insufficient randomness. As a result, attackers could theoretically have forged trusted HTTPS certificates and presented themselves to users as another website, according to Google.
According to eMudhra, the weak keys resulted from an error during a key-generation ceremony in April 2025. A procedure allegedly created a second, weak set alongside the intended strong keys. The company says the error went unnoticed for about a year and a half, despite checks and audits.
The browser providers acted quickly. Google blocked the certificate authorities involved through an update for Chrome and Android. eMudhra also reports that Apple, Google, Microsoft and Mozilla were informed, and that the certificates concerned have been revoked in browser programmes or are no longer trusted.
According to eMudhra, nothing will change for most customers. The eight intermediate authorities are said to have seen virtually no production use, and the one that was active allegedly issued no certificates for end users. The company says its Indian digital-signature and electronic-signing services operate on separate infrastructure.
According to eMudhra, the withdrawal affects approximately 1 per cent of revenue. The company intends to focus on other digital-identity and security services. For customers in the SSL and TLS division, the decision means that certificates must be replaced or transferred to another certificate authority. The precise cause of the error is still being investigated.
The incident shows how heavily the web depends on a limited number of organisations that issue certificates and manage trust. A weak key can have major technical consequences, but in this case the certificates concerned were blocked before there was evidence that they had been used for fraud. That distinction is important: the incident was serious, but no confirmed data theft has been reported.
Also show the region and a close-up
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The technical core has been confirmed by Google and eMudhra itself; the company’s decision is documented directly. Uncertainties about exploitation and the definitive cause are clearly presented as such.
- confirmed eMudhra is ending its global SSL and TLS certificate activities. — Announced directly by eMudhra. source
- confirmed Eight intermediate certificate authorities had weak private keys. — Google describes the insufficient cryptographic randomness; eMudhra names the same eight authorities. source
- confirmed Google blocked the certificates involved through a Chrome update. — Google Security describes the CRLSet measure. source
- confirmed There is no evidence of data theft or misuse. — eMudhra reports no infrastructure compromise or data breach; The Record describes misuse as unsubstantiated. source
- confirmed The SSL and TLS division accounts for approximately 1 per cent of revenue. — Provided by eMudhra in its explanation. source
Editor's note
The company’s decision and the technical measures have been confirmed by eMudhra and Google. The precise cause of the error and whether anyone misused the keys are still under investigation; no evidence of misuse or a data breach has been reported.Sources
More on this in Dutch media
- NOS — „emudhra ssl”
- Het Parool — „emudhra ssl”
- NRC — „emudhra ssl”