eMudhra exits global SSL/TLS business after key compromise

Indian certification authority eMudhra announced on Thursday that it is exiting its global SSL/TLS certificate business. The company stated that this segment contributes approximately one percent of its global revenue. eMudhra cited growing compliance costs and competition from free certificate providers as reasons for the withdrawal. The board concluded that leaving the market is the right decision for the company and its shareholders due to disproportionate scrutiny.

The decision was made five days after a researcher reported recovering the private keys of eight of eMudhra's intermediate CA certificates. The researcher reported the weak keys to Apple, Google, Microsoft, Mozilla, and eMudhra on October 17. eMudhra stated that a flaw in its key generation ceremony caused a wrap/unwrap step to produce a second set of weak keys alongside the original strong keys. The defective certificates were created during a Key Generation Ceremony held on April 30, 2025. The eight compromised private keys had sizes ranging from 3 to 8 bits, whereas NIST P-384 elliptic curve cryptography keys should contain roughly 384 bits of entropy. eMudhra stated that a flaw in the KGC script resulted in weaker keys being created onboard and used by mistake to create certificate signing requests because the key labels were similar.

Chrome and Firefox blocked the six TLS intermediates within hours of the discovery. Mozilla decided on October 20 to stop trusting the eMudhra root certificate in Firefox. Chrome is expected to stop trusting the eMudhra root certificate emSign ECC Root CA - G3 on the morning of October 27, Pacific time. As of October 21, about 30,800 unexpired certificates were chained to the affected eMudhra root according to Chrome's count. Google told website operators with certificates under the affected root that they must immediately acquire and install a new TLS certificate from another PKI hierarchy. eMudhra claimed that the affected CAs had issued no end-entity certificates and revoked those CAs within 14 hours of discovering the issue.

eMudhra will replace affected customers' certificates with free ones from partners, though the announcement did not name the partners or provide an exit date. eMudhra estimated that about 30,000 certificates need to be moved from the affected hierarchy.