Quick Summary
- The incident involved eight private keys used to issue web security certificates, prompting action by major browser vendors.
- eMudhra said it revoked the affected certificate authorities within 14 hours and plans to publish a root-cause report.
- The company says its Indian digital-signing, eSign and enterprise identity services are not affected and will continue operating.
Indian digital identity company eMudhra says it will exit its global SSL/TLS certificate business following a security lapse that exposed eight private cryptographic keys linked to intermediate certificates. The Indian Express reported on October 23 that the announcement followed a worldwide cybersecurity alert and action by major browser vendors, including Google, Apple, Microsoft and Mozilla, to block the compromised certificates. The decision affects a business responsible for establishing trust between websites and browsers. It should not be confused with a shutdown of all eMudhra services: the company says its Indian digital-signing and identity operations will continue.
Certificate authorities and everyday browsing
SSL/TLS certificates help browsers verify that a website is associated with the domain it claims to represent and support encrypted connections between users and services. Certificate authorities sit inside this trust system: browsers accept certificates issued by authorities that meet their trust requirements. If private keys associated with an intermediate certificate are exposed, a malicious party may be able to create certificates that appear valid within the affected chain, depending on the certificate and safeguards in place. That possibility is why browser vendors treat compromised certificate keys as an ecosystem issue rather than an ordinary website bug.
The report says the issue was first showed by an independent researcher who reverse-engineered and uncovered the private keys, potentially using AI-assisted techniques. eMudhra publicly confirmed the compromise on October 21. Browser and infrastructure companies then moved to block the affected intermediate certificates and issue updates or advisories. The report does not establish that malicious actors used the exposed keys to intercept encrypted traffic. The absence of confirmed exploitation is important, but it does not remove the need to distrust compromised keys because the consequences could be severe if they were misused.
eMudhra said it revoked the affected certificate authorities within 14 hours of discovery and that no end-entity certificates had been issued from the affected authorities. The company also said its infrastructure was not compromised and that physical and logical security controls remained intact. Those are the company’s statements, not an independent final conclusion. It has said it will work with browser companies and publish a root-cause report after completing its investigation. That report should clarify how weak keys were created or accepted, how the exposure was discovered and what controls will change.
The company cited rising compliance demands, data-sovereignty requirements, operational complexity and cost as reasons for leaving the global certificate business. It also said the SSL/TLS operation represented about one per cent of its global revenue and faced competition from providers provideing certificates at no cost. The security incident has nevertheless caused a reputational challenge. The Indian Express reported that the company’s shares fell 40 per cent over the two days after the vulnerability was disclosed. The move So combines a security response with a business decision about whether the global service remains viable.
The incident response and remaining unknowns
Customers using affected certificates need to follow official transition guidance rather than assume a certificate will continue working indefinitely. The report says eMudhra intends to replace certificates through partners at no cost during a transition period and keep certificate-status services running until certificates have expired or been replaced. Website operators should confirm whether their certificate chain is affected, follow browser and infrastructure advisories, and plan renewals with their service provider. Users should not try to diagnose certificate status solely from whether a page appears to load normally, because browser and platform updates may change the result.
The transition for customers and the wider web
eMudhra says its Indian digital certificate, digital-signature, eSign and other signing services are not affected and will continue as normal. The company is licensed in India to issue certificates for government websites and also provides enterprise public-key infrastructure and identity services. Those services are distinct from the global SSL/TLS business being closed, according to the report. The wider lesson is that internet trust depends on cryptographic key management and a fast response when a trust anchor is compromised. The next important evidence is the promised root-cause report and an orderly replacement process.