Security & FraudPublished:
eMudhra says it will exit the global TLS certificate business
eMudhra says its board chose to withdraw after the weak-key incident; its G1 RSA roots and certificate-status services will continue during the customer transition.
eMudhra says its board has decided to withdraw from the global SSL/TLS certificate business. The company announced the decision on October 22 after an incident involving weak keys in eight intermediate certificate authorities. TLS certificates help browsers verify a website’s identity and establish an encrypted connection. A certificate authority, or CA, issues these certificates.
What will happen during the transition
eMudhra says its G1 RSA roots will continue serving customers while it works with browser programs and customers on the transition. It says revocation and certificate-status services will continue until every issued certificate has expired or been replaced, and affected customers will receive free replacement certificates from partners.
The company also says it will complete its remaining commitments to browser root programs, including a full root-cause report. Its incident statement describes replacement certificates for one affected U.S. customer ecosystem as coming from an alternate, independently operated, publicly trusted CA hierarchy.
What the incident affected
According to eMudhra, seven of the eight affected intermediates were never used in production, and the one production intermediate issued no certificates. The company revoked all eight intermediates. It also says browser root programs distrusted one related ECC root; revoking intermediates and distrusting a root are separate actions.
What remains under investigation
eMudhra attributes the second, weak set of keys to a wrap-and-unwrap step during an April 30, 2025 key-generation ceremony, but says it has not confirmed the exact root cause. Its statements that infrastructure was not compromised, no data was breached and there is no known earlier exploitation remain company findings rather than independent assurances.
Other eMudhra services
eMudhra says its digital-signature, eSign, enterprise PKI, identity and authentication services use separate infrastructure and will continue operating. The announced withdrawal is limited to its global SSL/TLS certificate business.
