eMudhra Exits Global SSL/TLS Certificate Business Following the Vulnerability Disclosure

eMudhra Limited has announced it is exiting the global SSL/TLS certificate business after disclosing weak private keys in eight intermediate certificate authority certificates. The October 22, 2026, decision follows emergency browser protections and growing questions about the company’s certificate issuance controls. eMudhra said its other digital trust services remain unaffected.

In its official announcement, the company said its board approved the voluntary exit after reviewing the incident and the business outlook. Chairman V. Srinivasan said eMudhra revoked the affected CA certificates within 14 hours of discovery and promptly disclosed the issue.

The company said none of the affected intermediate CAs had issued end-entity certificates, which websites or software publishers use. It also said its infrastructure was not compromised, no data was breached, and all physical and logical security controls remained intact.

Weak Private Keys Triggered Emergency Action

The incident began with an October 17 report from a researcher identified as Wayne. According to Mozilla’s public incident record, the researcher supplied proof of control over eight private keys. Mozilla independently recovered the keys, confirming that their generation process was seriously flawed. Six affected certificates supported TLS, while two supported code signing.

The technical problem was a lack of randomness. CERT-In said the affected P-384 elliptic-curve private keys had values smaller than 256, allowing them to be recovered almost instantly from their public keys. The failure was in key generation, not in the P-384 algorithm itself.

eMudhra’s preliminary explanation pointed to an April 30, 2025, key-generation ceremony. A flawed script used during a key wrap and unwrap step created a second, weak set of keys. Similar key labels then led staff to use those weak keys in certificate signing requests instead of the original strong keys.

As covered in CybersecurityNews’ earlier report on the eMudhra certificate authority compromise, the issue prompted emergency blocking measures. Anyone recovering these keys could potentially issue false certificates. Where affected chains remained trusted, an attacker able to intercept network traffic could impersonate websites or alter communications.

Google and Mozilla blocked the affected TLS keys on October 17. Both also moved toward removing trust in emSign ECC Root CA – G3, protecting clients that do not reliably receive or enforce intermediate certificate revocation information. CERT-In said Chrome’s root-store change was expected to reach relevant devices on October 27.

eMudhra estimated that about 30,000 certificates required migration. Those certificates should not be confused with certificates issued by the eight weak intermediates. CERT-In said public disclosures had not established confirmed malicious exploitation as of October 21.

The response reflects the wider consequences of certificate authority failures, also seen in Google’s removal of two certificate authorities from Chrome. Browser trust decisions can force website operators to replace otherwise valid certificates to keep services accessible.

eMudhra said global SSL/TLS contributes about 1% of its revenue. Rising data sovereignty requirements, compliance costs and competition from free certificate providers have reduced the business’s returns. Srinivasan also argued that social media scrutiny was out of proportion to the segment’s size.

The company plans to keep its G1 RSA roots serving customers during the transition and provide replacement certificates through partners at no cost. Revocation and certificate status services will continue until issued certificates expire or are replaced. It also committed to completing browser-program obligations, including a full root-cause report.

Meanwhile, CERT-In’s advisory urges administrators to update browsers and trust stores, review certificate chains, and replace affected certificates. Teams should also check separate certificate bundles in applications, containers, and network devices, rather than assuming browser updates protect every system.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post eMudhra Exits Global SSL/TLS Certificate Business Following the Vulnerability Disclosure appeared first on Cyber Security News.