eMudhra announced on October 22, 2026 that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business. The decision came just two days after researchers revealed the Indian certificate authority had issued eight intermediate TLS certificates with private keys so weak that anyone could crack them in milliseconds and mint trusted certificates for any website or mail server.
The company said the withdrawal lets it sharpen focus on its core enterprise solutions and trust services other than SSL/TLS. Chairman V. Srinivasan cited rising compliance costs, the business contributing roughly 1 percent of global revenue, and free TLS certificate providers such as Let's Encrypt reducing returns. He also said the social media amplification around the incident brought scrutiny out of proportion to the unit's size.
The weak TLS keys behind the eMudhra exit
According to Ars Technica, eMudhra issued eight intermediate TLS credentials so weak that anyone could generate certificates trusted by all major browsers, plus email servers, IoT devices, Docker containers and unmaintained tools carrying their own copy of the root store. NIST P-384 keys are supposed to hold about 384 bits of entropy; these had key sizes from 3 to 8 bits.
eMudhra explained that a flaw in the Key Generation Ceremony script caused a wrap/unwrap step to produce a second set of weak keys alongside the intended strong ones, and that the weak keys were mistakenly used to create the certificate signing request because the key labels were similar. The company said the CSR was also sent to fellow certificate authority Sectigo for cross-signing.
- Eight intermediate TLS certificates affected, issued under eMudhra's ECC root.
- Private key entropy ranged from 3 to 8 bits, versus the roughly 384 bits expected for NIST P-384 keys.
