eMudhra to exit global SSL/TLS business after key flaw; MeitY sets up probe
Representative image: TheOtherKev / Pixabay
eMudhra said on October 22, 2026 it will exit the global SSL/TLS certificate business after its weak-key incident; MeitY has set up a special team to probe it.
What Happened
eMudhra, the Bengaluru-based digital certificate company, said on Thursday, October 22, 2026 that its board has decided to withdraw from the global SSL/TLS certificate business, the part of its operations that issues certificates securing websites. The decision follows a security incident in which private keys behind eight of its intermediate certificates were found to be weak, prompting the major web browsers to block them. Separately, the Ministry of Electronics and Information Technology (MeitY) has formed a special team to investigate the incident, government sources said on October 21.
Key Facts
- Exit: eMudhra's board decided to voluntarily withdraw from the global SSL/TLS certificate business, the company announced on October 22, 2026.
- Reasons given: rising compliance costs, operational complexity and declining commercial viability, including competition from providers that issue such certificates free of charge.
- Size: one report said the business contributes about 1% of eMudhra's global revenue.
- Customers: the company says it will contact affected customers and replace certificates free of cost through partners during the transition; its existing roots will serve customers until the move is complete.
- Government response: MeitY formed a special team to probe the incident; sources said the impact on Indian websites and apps was "very limited and for a very short interval".
- What is unaffected: the incident relates to eMudhra's international certificate business; India's digital signature certificates and eSign services are not affected, according to reports citing the ministry.
- CERT-In: the national cyber agency said the keys were "generated with insufficient cryptographic randomness" and warned that recovered keys could be used to issue fraudulent certificates.
Why It Matters
When a browser shows a padlock next to a web address, it is trusting a chain of digital certificates. A certificate authority vouches that a website belongs to whoever runs it, and intermediate certificates sit between the authority's root and individual websites. Earlier this month, researchers found that the private keys behind eight eMudhra intermediates were so weak they could be worked out, which could in principle have let an attacker forge certificates. Browser makers blocked the certificates between October 17 and 20.
The company's decision to leave this business entirely is the most significant consequence so far. Certificate authorities depend completely on the trust of browser makers, who decide which authorities their software accepts. After an incident of this kind, rebuilding that trust can be slow and costly. eMudhra has chosen instead to step away from website certificates, a small part of its revenue by its own account, and concentrate on its other enterprise and trust services.
The government's response matters because eMudhra is an Indian company that also provides digital signature services in India. By setting up a special team, MeitY is signalling that it wants a clear account of what went wrong. The ministry's early message, through sources, has been reassuring: the effect on Indian websites was brief and limited, and the digital signature and eSign services used in India to sign documents are separate and unaffected.
For website owners using eMudhra certificates, the practical step is to replace them through the company's transition arrangements before they stop working. Ordinary users do not need to act, because browsers have already blocked the affected certificates.
| Date | Development |
|---|---|
| October 17-20, 2026 | Browsers block eight eMudhra intermediate certificates |
| October 21, 2026 | MeitY forms special team to investigate, sources say |
| October 22, 2026 | eMudhra announces exit from global SSL/TLS business |
Impact
Short-term: Customers with eMudhra website certificates will move to other providers through the company's partners. MeitY's special team will examine how the weak keys were generated.
Long-term: The exit removes an Indian company from the global market for website certificates. The episode is likely to sharpen scrutiny of key-generation practices at certificate authorities everywhere.
Who is affected: eMudhra's website-certificate customers, its shareholders and staff, Indian regulators and CERT-In, and the browser makers that police certificate trust.
Key Takeaway
eMudhra said on October 22, 2026 that it will leave the global SSL/TLS certificate business after the weak-key incident, while MeitY has formed a special team to investigate and says the impact on Indian websites was very limited.
Questions and Answers
Why is eMudhra exiting the SSL/TLS certificate business?
eMudhra said on October 22, 2026 that its board decided to withdraw after a security incident involving eight intermediate certificates. It cited rising compliance costs, operational complexity and declining commercial viability, including competition from free certificate providers.
Are India's digital signatures and eSign affected by the eMudhra incident?
No. According to reports citing MeitY, the incident relates to eMudhra's international website-certificate business, and India's digital signature certificates and eSign services are unaffected.
What is the government doing about the eMudhra incident?
MeitY has formed a special team to investigate, according to government sources on October 21, 2026. CERT-In has issued an advisory saying the keys were generated with insufficient randomness.
Do ordinary internet users need to do anything?
No. Major browsers blocked the affected certificates between October 17 and 20. Website owners using eMudhra certificates should replace them through the company's transition arrangements.
Disclaimer: Prepared by the Peepals newsroom from publicly available sources with AI assistance. Information is accurate to the best of our knowledge at the time of publication and may change. Images may be representative. Not professional advice. Report an error via our contact page.
Sourced and fact-checked by the Peepals Global Editorial Team
Ad-tech roles lead fresher demand in Delhi, Mumbai: TeamLease EdTech report
OpenAI nears $30 billion raise at $1.25 trillion valuation, UAE investors leading
Reported, fact-checked and published by the Peepals Global Editorial Team.
