Key Takeaways
- The eMudhra SSL Certificate Business will stop issuing SSL/TLS certificates after a serious security flaw.
- Researchers reconstructed 8 weak private keys in less than 1 second.
- The company’s shares fell 40% in 2 days after disclosure.
Indian digital security company eMudhra will exit its global SSL/TLS certificate business after researchers found that 8 of its private keys could be reconstructed in less than a second. The eMudhra SSL certificate business exit follows browser restrictions on the affected certificates and a review of the security incident. The company announced the decision on Thursday, following browser restrictions on the affected certificates and a review of the security incident. eMudhra said its other businesses, including digital signatures and enterprise security services, continue to operate normally.
eMudhra SSL certificate business exit after key flaw
The security issue behind the eMudhra SSL certificate business exit began when a researcher reported that the private keys linked to 8 eMudhra intermediate certificates could be calculated from their public certificates. The keys had been generated with too little randomness, making them easy to reconstruct. The researcher recovered all 8 keys on a laptop in less than a second.
Private keys help establish trust between websites and users by supporting the digital certificates that confirm a website’s identity. If attackers obtain weak certificate keys, they may be able to create fake certificates and impersonate websites. In this case, the researchers demonstrated that the keys were weak enough to calculate, but the available information does not establish that anyone used them maliciously.
eMudhra traced the flaw to an error during a key generation process in April 2025. The company said the error created a second, weak set of keys that was published to browser trust lists instead of the intended keys. It stated that its infrastructure had not been compromised, no data had been breached, and none of the 8 affected intermediate certificates had issued end-user certificates.
The company’s board decided to exit the SSL/TLS certificate business after reviewing the matter. Chairman V. Srinivasan cited rising costs linked to data sovereignty and compliance requirements, along with competition from providers offering certificates for free. He also said the public attention surrounding the incident had increased scrutiny of the business.
eMudhra SSL certificate business exit triggers browser restrictions
Major technology companies moved to block the affected certificates after the flaw was reported. Chrome and Firefox acted within hours, while Apple blocked the certificates on Monday and Microsoft followed on Tuesday. Mozilla removed eMudhra’s root certificate from its trusted list, while Google said it planned to remove that root from Chrome in an upcoming update and review the company’s remaining root certificate.
Updates also reached Go, Node.js, Python’s certifi package, and several Linux distributions. India’s Computer Emergency Response Team (CERT-In) said it had not observed malicious use of the keys as of Wednesday.
The eMudhra SSL certificate business exit also affected investor sentiment. The company’s shares fell 40% over the 2 days after the vulnerability was disclosed, reflecting the market reaction to the security issue and the decision to leave the business.
eMudhra said its other digital services would continue to operate normally. These include digital signature solutions and enterprise security services. However, the company acknowledged that the reputational impact of the incident could not yet be measured.
The eMudhra SSL certificate business exit marks a significant change in the company’s business portfolio as it withdraws from issuing SSL/TLS certificates. The company has not reported a confirmed misuse of the weak keys, and the available details do not establish whether any outside party used them. Its other operations remain active while the company moves away from the certificate business.
