Indian digital security firm eMudhra has decided to withdraw from the global SSL/TLS certificate business after a security issue involving eight digital certificates raised concerns about website authentication. The Bengaluru-based company’s board approved the decision on Thursday, October 22, following the discovery of weaknesses that could potentially allow attackers to create fraudulent security certificates and impersonate legitimate websites.
The incident prompted Google, Mozilla and other major technology companies to take precautionary measures. However, eMudhra has maintained that its systems were not hacked and that no customer data was stolen.
The company has also stated that its global certificate business accounts for approximately 1% of its total revenue. Despite the limited contribution, the incident has drawn attention to the security and reliability of digital certificate infrastructure.
Why Is eMudhra Leaving the SSL/TLS Certificate Business?
The issue came to light after an independent security researcher identified unusually weak private keys in eight intermediate certificates issued by eMudhra.
Intermediate certificates play an important role in the digital certificate system used by web browsers to verify the authenticity of websites. If compromised or improperly secured, they can potentially be misused to generate fraudulent HTTPS certificates, allowing attackers to impersonate legitimate websites.
According to eMudhra, the weakness originated during a certificate key-generation process in April 2025. The company subsequently revoked the affected certificates and launched an investigation to determine the cause of the problem.
The discovery led major technology companies to take protective action to reduce potential risks to users and online services.
Centre Orders Investigation Into the Security Incident
The Central government took note of the incident involving eMudhra’s Public Key Infrastructure (PKI) on Wednesday, October 21.
The Ministry of Electronics and Information Technology (MeitY) formed a special team to investigate the matter. Meanwhile, the Indian Computer Emergency Response Team (CERT-In) issued a security advisory outlining the potential risks and recommended protective measures.
According to the information provided, the government indicated that the impact on Indian websites and applications had been limited.
The investigation is intended to establish the circumstances surrounding the certificate weaknesses and assess the potential consequences for affected digital services.
Will eMudhra’s Indian Digital Signature Services Be Affected?
eMudhra has clarified that its Indian Digital Signature Certificate (DSC) and eSign services remain unaffected by the incident.
The company says these services operate on separate infrastructure and will continue functioning normally. It is also working with affected customers to replace certificates and minimise the risk of service disruptions.
The distinction between the global SSL/TLS certificate business and the company’s domestic digital signature services is important for customers concerned about the availability of their existing services.
What Happens Next for eMudhra?
The decision to leave the global SSL/TLS certificate business marks a significant development for the Bengaluru-based company. Its immediate priorities include addressing the certificate issue, coordinating with affected customers and completing the necessary security measures.
The incident has also highlighted the importance of secure certificate generation and reliable systems for verifying website identities. The findings of the ongoing investigation should provide further clarity on the cause of the weakness and its wider implications.
Disclaimer
This article is intended for general informational purposes only. The details presented are based on the information provided and have not been independently verified. Security investigations and company decisions may develop as further information becomes available. Readers should refer to official eMudhra statements, MeitY announcements and CERT-In advisories for confirmed updates. This article should not be interpreted as a technical security assessment or legal advice.