Bengaluru-based digital identity and cybersecurity company eMudhra has decided to withdraw from the global website-security certificate business after a cryptographic flaw exposed a fundamental weakness in eight intermediate certificates used within its international operations, triggering action by major browser providers and an investigation by Indian authorities.
The decision, announced on October 22, follows a security incident that raised concerns about the integrity of the digital certificates underpinning trust across the internet. Google, Mozilla, Apple and Microsoft moved to block the affected certificates after an independent cybersecurity researcher identified the vulnerability.
The flaw originated in a key-generation process conducted on April 30, 2025. According to eMudhra, an error during a cryptographic key-generation ceremony produced a second set of weak private keys alongside the intended strong keys. The weak keys were subsequently published to browser trust stores.
The incident matters because SSL/TLS certificates help browsers verify website identities and establish encrypted connections between users and servers. If attackers can recover a certificate authority’s private key, they may be able to create fraudulent certificates, impersonate legitimate websites or make malicious software appear to originate from a trusted publisher.
eMudhra said its infrastructure had not been compromised and no data had been breached. It also said the affected intermediate certificates had not been used to issue certificates to individual websites or end users. The extent of any actual exploitation was not established in the initial disclosures.
“We do have to solve for reputation in the short to medium term, which is what we are working on by actively reaching out to customers, and trying to explain to them that if this incident is something that can happen to us, it can happen to anybody,” Kaushik Srinivasan, co-founder, eMudhra, told The Indian Express.
When asked if the reputational fallout could extend to its dealings with Indian government clients, Srinivasan replied, “I don’t think so. Advisories from the government have also come based on questions posed to us that there was no impact on the ecosystem.”
The company described its decision to exit the global business as voluntary, citing rising compliance requirements, operational complexity and costs. It also criticised what it called disproportionate scrutiny amplified by social media following the incident.
The withdrawal marks a significant setback for an Indian company operating in the international digital-trust market, even as eMudhra maintains that its domestic digital-signature and electronic-signing operations remain unaffected.
Weak cryptographic keys trigger global browser response
The incident centres on the generation of eight intermediate certificates within eMudhra’s global public-key infrastructure. Such certificates allow trusted certificate authorities to issue further certificates used to establish the authenticity of websites and digitally signed software.
The problem was not initially described as a conventional intrusion into company systems. Instead, eMudhra attributed the vulnerability to an error during the key-generation process, which resulted in weak cryptographic keys being published alongside the intended security credentials.
The distinction is important. A certificate authority’s security depends not only on protecting its infrastructure but also on generating sufficiently unpredictable private keys. If those keys can be recovered or guessed, the trust placed in certificates issued under them can be undermined even without a conventional network breach.
An independent researcher reported the weakness to major browser trust programmes. Google, Mozilla, Apple and Microsoft subsequently took steps to block the affected certificates within their respective trust systems.
The potential consequences of such a flaw extend beyond a single company’s operations. Fraudulent certificates can, in principle, enable impersonation of legitimate websites or undermine confidence in digitally signed software. These are potential attack scenarios, however, and should not be confused with evidence that such attacks actually occurred in this incident.
The company said it revoked all eight affected intermediate certificates and was working with customers to provide replacement certificates where necessary. It also said it was investigating the root cause of the key-generation error.
India’s Computer Emergency Response Team (CERT-In) issued an advisory concerning the incident, while the Ministry of Electronics and Information Technology constituted a special team to investigate the security lapse.
The investigation will be important in establishing how the weak keys were generated, why they entered browser trust stores and whether existing safeguards and audits should have detected the problem earlier.
Indian digital-signature services remain separate from global business
eMudhra has stressed that the incident does not affect its Indian Digital Signature Certificate (DSC) and eSign services, which operate on infrastructure separate from the global SSL/TLS business.
The distinction matters for Indian users and organisations that rely on digital signatures for electronic documents, business transactions and government-related services. A company’s participation in the global browser-trust ecosystem is separate from its domestic role in providing regulated digital-signature services.
The company said its global TLS business contributes approximately 1% of its revenue, limiting the direct financial significance of the division relative to its wider operations. However, it acknowledged that the reputational consequences of the incident could not yet be quantified.
The market reaction has nevertheless been severe. Reuters reported that eMudhra’s shares fell around 40% over two trading sessions following the disclosure of the vulnerability.
The episode also highlights the importance of independent oversight in digital-security infrastructure. Certificate authorities occupy a critical position in the internet’s trust system, and their security practices can affect users and organisations far beyond their immediate customer base.
The key questions now concern the investigation’s findings, the effectiveness of the safeguards surrounding certificate generation, and the measures required to prevent similar failures. The incident also places renewed scrutiny on how audits assess the actual security of cryptographic processes rather than merely confirming that procedures exist.
For eMudhra, exiting the global certificate business may limit its exposure to the immediate problem, but it does not eliminate the need to establish precisely how the flaw occurred and whether the response adequately addressed the risks.
For the wider internet, the episode serves as a reminder that encrypted connections depend on a chain of trust involving certificate authorities, browser providers, software vendors and security researchers. A weakness at one point in that chain can prompt a global response, even when the company involved says its wider infrastructure and data remain secure.
FAQs
1. Why is eMudhra exiting its global certificate business?
The company announced a voluntary withdrawal after a cryptographic key-generation flaw affected eight intermediate certificates. It also cited rising compliance demands, operational complexity and costs.
2. What went wrong with eMudhra’s security certificates?
A flaw during a key-generation ceremony on April 30, 2025, produced weak private keys alongside the intended strong keys. The weak keys were published to browser trust stores.
3. Which companies blocked the affected certificates?
Google, Mozilla, Apple and Microsoft moved to block the affected certificates within their respective browser and technology trust systems.
4. Were users’ personal data or eMudhra’s systems breached?
eMudhra said its infrastructure was not compromised and no data was breached. The company also said the affected intermediate certificates had not issued certificates to individual websites or end users. The initial disclosures did not establish actual exploitation.
5. Are eMudhra’s Indian digital-signature and eSign services affected?
The company says its Indian DSC and eSign services remain unaffected because they operate on infrastructure separate from its global TLS business.
6. What role is the Indian government playing?
CERT-In issued an advisory, and the Ministry of Electronics and Information Technology constituted a special team to investigate the incident.
7. How much revenue does the global certificate business contribute?
eMudhra said the global TLS business accounts for approximately 1% of its revenue. It warned that the reputational impact could not yet be quantified.
Shelton Rozario 
Srinivas Chakravarty