Bengaluru-based eMudhra will exit the global website authentication certificate business after a security flaw left eight intermediate certification authority certificates vulnerable to potential misuse. The company's Indian digital signature and eSign services will continue to operate as usual.
The company's board approved the decision on October 22, following scrutiny of the incident involving weak private keys generated due to a flaw dating back to April 2025, according to media reports..
SSL/TLS certificates help browsers verify website identities and establish encrypted connections, forming a critical layer of security for online banking, e-commerce and government services.
Also Read | Layoffs Are Rising In Tech, But These Skills Are Helping People Unlock Better Pay
ALSO READ: eMudhra Certificate Issue Raises Trust Concerns, Not Data Leak Risks: Voyager Infosec's Jiten Jain
eMudhra Chairman V Srinivasan said the company revoked the affected certificate authorities within 14 hours of discovering the issue. He added that the incident did not involve a breach of the company's infrastructure or data, and the affected certificates had not been used to issue certificates to individual websites or end users.
The global website security certificate business contributes around 1% of eMudhra's revenue, Srinivasan said, adding that the scrutiny following the incident also influenced the board's decision.
The company will work with browser makers and customers to ensure a smooth transition. It will replace affected customer certificates free of cost through its partners and continue certificate status and revocation services until all issued certificates expire or are replaced.
The incident highlights the risks posed by weaknesses in digital certificate management. Cryptographically weak private keys could potentially allow attackers to create fraudulent certificates, impersonate legitimate websites and facilitate phishing attacks on vulnerable systems.
Vineet Kumar, Founder and Global President of CyberPeace, told ANI that the episode underlined the need for independent technical verification, continuous trust monitoring and stronger cybersecurity safeguards.
Kumar stressed that the incident did not indicate a failure of the underlying cryptographic technology. Instead, it stemmed from faulty key generation, rather than a mathematical break of the cryptographic algorithm.
He also warned that blocking affected certificates could disrupt legitimate websites and applications that had not migrated to unaffected certificates, particularly those operated by small and medium enterprises.
Browser providers, including Google and Mozilla, moved to block the affected certificates. CyberPeace urged organisations to identify and replace them ahead of Google's planned root certificate removal on October 27, 2026.
ALSO READ: eMudhra Security Incident: MeitY Sets Up Panel To Probe Security Glitch; CERT-In Flags Mitigations
The organisation also recommended regular browser and device updates, certificate transparency monitoring, rapid revocation and stronger key-management practices. Users were advised not to bypass security warnings, to verify website addresses and to enable two-factor authentication.
The Ministry of Electronics and Information Technology (MeitY) said India-specific digital signature and eSign services remained unaffected. It has formed a special team to investigate the incident and is coordinating with stakeholders, while CERT-In has issued an advisory outlining mitigation measures.
Meanwhile, eMudhra shares ended more than 20% lower at Rs 345.60 on the National Stock Exchange on Thursday, trading in the red throughout the session.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.
