eMudhra exits global SSL business after researcher recovers private keys for eight intermediate certificates

eMudhra Limited announced on October 22, 2026, that it is exiting the global SSL/TLS certificate business. The company’s board approved the voluntary withdrawal after reviewing an incident involving weak private keys in eight intermediate certificate authority certificates, according to Cyber Security News.

The decision follows emergency protections implemented by major browser vendors and growing scrutiny of the company’s certificate issuance controls. eMudhra stated that its other digital trust services remain unaffected by this strategic shift, maintaining operations in areas outside the SSL/TLS market.

Context and background

The incident originated from a report submitted on October 17 by a researcher known as Wayne, according to Mozilla’s public incident record. The researcher provided proof that he could control eight private keys, which Mozilla independently verified. The keys were found to be seriously flawed due to a lack of randomness during generation.

CERT-In explained that the affected P-384 elliptic-curve private keys had values smaller than 256, allowing for near-instant recovery from their public keys, according to Cyber Security News. Ars Technica reported that the key sizes ranged from 3 to 8 bits, with specific private key values including 4, 56, 66, 115, 155, 156, 230, and 237.

eMudhra attributed the error to a key-generation ceremony held on April 30, 2025. A flawed script used during a key wrap and unwrap step created a second set of weak keys. Staff members then mistakenly used these weak keys in certificate signing requests instead of the original strong keys, according to the company’s preliminary explanation.

Who is affected

Six of the eight affected certificates supported TLS, while two supported code signing, according to Cyber Security News. eMudhra stated that none of the affected intermediate CAs had issued end-entity certificates for websites or software publishers. The company also asserted that its infrastructure was not compromised and no data was breached.

Google and Mozilla blocked the affected TLS keys on October 17. Both organizations also initiated steps to remove trust in emSign ECC Root CA – G3, protecting clients that do not reliably enforce intermediate certificate revocation information, according to Cyber Security News.

Chrome is expected to stop trusting the eMudhra root certificate on the morning of October 27, Pacific time, according to The Hacker News. Mozilla decided on October 20 to stop trusting the same root in Firefox. Google told website operators with certificates under that root to immediately acquire and install new TLS certificates from another PKI hierarchy included in the Chrome Root Store.

Approximately 30,800 unexpired certificates chained to that root existed as of October 21, according to Chrome’s count of public Certificate Transparency logs. The Hacker News reported that 99.9% of these were issued through InCommon, a service for the higher education community created by Internet2.

eMudhra said it will replace affected customers' certificates with free ones from partners, though it did not name the partners or provide a specific exit date. The company noted that the global SSL/TLS business generates about 1% of its revenue and faces complex data sovereignty and compliance rules.

What should you do?

Website operators and security teams should verify if any of their certificates chain to the emSign ECC Root CA – G3. If so, they must replace them with certificates from a different trusted hierarchy to ensure continued browser compatibility and security.

Organizations should monitor browser vendor updates and trust store changes, particularly regarding Chrome and Firefox, to anticipate when trust for eMudhra’s root certificates will be removed. This helps prevent service disruptions for users.

Security professionals should review their internal certificate inventory to identify any reliance on eMudhra-issued intermediate certificates. Even if eMudhra claims no end-entity certificates were issued, verifying trust chains is critical to maintaining secure communications.

What to do and how to stay safe: eMudhra

• Check your organization’s public-facing services for certificates issued by eMudhra or chained to emSign ECC Root CA – G3.
• Contact your certificate provider to confirm if any certificates need immediate replacement with those from a different root store.
• Monitor browser vendor announcements for updates on trust removal schedules to plan migration before deadlines.
• Review internal systems and email servers for any reliance on eMudhra certificates, as these may also be impacted by trust store changes.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did eMudhra revoke the affected certificates?

Yes, eMudhra revoked the affected CA certificates within 14 hours of discovery, according to Chairman V. Srinivasan.

Are any end-entity certificates compromised?

eMudhra stated that none of the affected intermediate CAs had issued end-entity certificates for websites or software publishers.

Why is eMudhra exiting the SSL/TLS business?

The company cited the incident, increasing compliance costs, and the low revenue contribution of the business as reasons for its exit.