eMudhra Exits SSL Certificate Business After Security Flaw

Indian digital trust company eMudhra said on Thursday it will voluntarily withdraw from the global SSL certificates business after an independent researcher found serious flaws in digital certificates it had issued. The announcement followed moves by Google, Mozilla, Apple and Microsoft, whose browsers stopped trusting the SSL certificates issued by eMudhra. The company said its board approved the exit and that it will instead concentrate on enterprise software and other digital trust services. The SSL/TLS certificate business accounted for about one percent of its global revenue.

The disclosure sparked concerns among cybersecurity professionals about internet security and privacy. SSL and TLS are the protocols that secure data sent between web browsers and servers, keeping private information from being intercepted.

How the weak keys were found at eMudhra

An anonymous security researcher identified as Wayne found the problem over the weekend and proved control of eight private keys by using them to sign a message. The eight keys belonged to intermediate certificate authorities run by eMudhra. Each used P-384 elliptic-curve cryptography, but the private-key values were all below 256. A normal P-384 key is chosen unpredictably from a range of about 10^115 possible values. These keys could be recovered by testing at most 255 values, meaning an attacker could work them out in less than a second.

Six of the eight certificates were permitted to issue TLS certificates for websites, which could have let an attacker impersonate domains they did not control on systems that still trusted the keys. The other two were meant for code signing. Intermediate certificate authorities sit between root certificates and the certificates that websites present, and browsers trust these intermediaries to establish a website's identity. eMudhra said the flaw originated in an error during a key-generation process in April 2025. The company said it revoked the affected authorities after discovering the issue and is investigating the root cause. It added that the affected authorities had not issued certificates to end users.

Browser makers and regulators respond to the eMudhra flaw

Google's Chrome Root Program received the researcher's report and blocked the public-key hashes of the six TLS-issuing intermediates, extending the protections to supported Android devices. Mozilla said protections were already available to Firefox users running standard configurations. Apple also introduced safeguards, and Microsoft blocked the certificates in its trust systems.

On Wednesday, India's Computer Emergency Response Team (CERT-In) issued an advisory saying some of eMudhra's intermediate certificates were compromised. The CERT-In advisory was followed by word that the Ministry of Electronics and Information Technology had formed a special team to investigate the incident. The authorities distinguished the affected international website-certificate business from eMudhra's domestic digital signature and eSign services, which remain operational.

Fallout for eMudhra customers and investors

Cybersecurity researchers said anyone holding a compromised TLS-issuing key could have created a fraudulent certificate for a domain they did not control, and could have used it to impersonate a legitimate website or intercept and modify traffic if they could also intercept the victim's connection. eMudhra issues digital certificates to digital businesses and government agencies, including for some online public services such as India's income tax portal. Its customers include the Indian IT services companies Infosys and TCS. The company said its infrastructure was not compromised and no data was breached.

Shares of the company fell 40 percent in the two days after the vulnerability was disclosed. In a follow-up statement, eMudhra said the level of social media attention around the incident had brought scrutiny that was out of proportion with the significance of the business line to the company.