eMudhra Exits Global TLS Business After Key Security Flaw
eMudhra is exiting the global SSL/TLS certificate business after a cryptographic flaw exposed eight intermediate certificates, leading to blocks by Google, Apple, Microsoft, and Mozilla Corporation.
Major browser and software providers including Google, Apple, Microsoft, and Mozilla Corporation blocked eight intermediate digital certificates issued by eMudhra after researchers discovered a critical cryptographic flaw. The vulnerability, identified on October 17, 2026, stemmed from a script error during a Key Generation Ceremony in April 2025. This error produced private keys with insufficient randomness—some as small as the number 4—allowing them to be recovered almost instantly by AI agents and researchers.
In response to the security lapse, eMudhra revoked the affected certificates on October 18. Google further announced the removal of the emSign ECC Root CA - G3 certificate from the Chrome Root Store by October 27. While eMudhra and the Ministry of Electronics and Information Technology of India stated that no user data was breached and only one certificate was deployed in production, cybersecurity experts warned that legacy apps and older servers remain vulnerable.
The Indian Computer Emergency Response Team (CERT-In) issued a security advisory and launched a probe into the incident, while the Ministry of Electronics and Information Technology formed a special investigation team. Following these developments, eMudhra's stock plummeted approximately 40% over two days. The company has since announced its voluntary exit from the global SSL/TLS certificate business, noting that the affected vertical accounts for only 1% of its total revenue.
