eMudhra has announced an eMudhra SSL/TLS exit, withdrawing from the global business of issuing website security certificates after eight of its intermediate certificate private keys were found to be dangerously weak. The company announced the decision on Oct. 22, after Google, Apple and Microsoft stopped trusting its SSL/TLS certificates, Reuters reported.
The immediate problem was not a flaw in TLS encryption itself. It was the keys used to authenticate certificate authorities. Cloudflare said an attacker could use the weak keys to forge a certificate for any domain, impersonate a server and potentially intercept or alter traffic where the affected certificate chain remained trusted.
SSL/TLS certificates let a browser or application verify that it is talking to the intended website and establish an encrypted connection. A certificate authority's private key is supposed to remain secret. If it can be recovered, the trust model has a rather serious hole in it. For background on the underlying public-key model, see RSA encryption explained.
What does eMudhra's SSL/TLS exit mean for customers?
eMudhra said the shutdown will be a transition rather than an immediate switch-off. It plans to move customers to other certificate providers, continue revocation and certificate-status services until certificates expire or are replaced, and finish its browser-root-program commitments, including a root-cause report.
The company said global SSL/TLS accounted for about 1% of its revenue. It cited compliance costs, operational complexity, competition from providers offering free certificates and increased scrutiny following the incident. Those are eMudhra's stated reasons for leaving the market, not an independent accounting of its decision.
eMudhra told Reuters that software had mistakenly shortened eight keys generated in April 2025. The company has said a defect in a key-generation ceremony produced weak keys alongside the intended stronger ones, and that the weak set was published to browser root stores. It also said the issue went unnoticed for 18 months, passed two independent audits, and that it revoked the affected certificates within 14 hours of discovery.
eMudhra maintains that its infrastructure was not compromised and that the incident caused no data breach. The company also said the affected intermediate authorities issued no end-entity certificates. Those remain company statements. Cloudflare said its own review found no active exploitation on its services, which does not establish what may have happened elsewhere.
Why browser blocking is not the whole fix
Browser vendors can remove trust centrally, but software outside the browser often carries its own certificate bundle or trust-store configuration. Cloudflare said customers may need to update software, review custom trust stores and origin-server configurations, rebuild container images, and restart or redeploy applications to make fixes take effect.
That leaves a messier tail of older devices, bundled dependencies and applications that use a different TLS verification path than a browser. Cloudflare cautioned that a successful browser or curl test does not prove every application on a device is protected, and advised operators not to disable certificate verification just to make post-update errors disappear.
India's Ministry of Electronics and IT said it was investigating the incident. CERT-In warned that exploitation of compromised private keys could enable website impersonation or traffic interception and modification, potentially exposing credentials and other sensitive data.
This story draws on original reporting from The Record.
