eMudhra Limited’s board has approved an exit from its global SSL/TLS certificate business after weak private keys were found in eight intermediate authorities, leaving customers to move certificates during a staged transition.
The company said the decision was made Thursday, Oct. 22. It put the business at about 1% of revenue and cited rising compliance demands, greater complexity and costs, competition from free certificate providers, and lower returns.
In an incident update, eMudhra traced the weak keys to a generation ceremony held April 30, 2025. The company said a step for wrapping and unwrapping keys produced an additional weak set alongside the intended keys, and the weak keys entered browser root stores. It said just one of the eight authorities entered production, and that authority issued no certificates. V. Srinivasan, eMudhra’s chairman, said the incident involved neither an intrusion into company systems nor exposure of data.
Mozilla’s Dennis Jackson said an attacker might use the weak keys to create a false HTTPS security certificate for an unrelated website. The Chrome Root Program said a researcher’s report arrived at 2:05 p.m. ET (18:05 UTC) on Oct. 17, and Chrome blocked six TLS intermediates at 3:45 p.m. ET (19:45 UTC). Mozilla recorded a report at 4:06 p.m. ET (20:06 UTC) and said Firefox had blocked the affected certificates by 6:59 p.m. ET (22:59 UTC). EconoTimes previously covered the browser blocks.
Chrome’s search of Certificate Transparency logs found no website certificates linked to the six TLS intermediates before the block, the program said. That search covers entries in the logging system; it does not settle whether the keys were misused in ways that left no logged certificate.
eMudhra said browser programs also removed trust in an ECC root higher in the certificate chain as a precaution. The company said that action affects one U.S. customer ecosystem, where replacements are being prepared. It plans to keep its G1 RSA roots serving customers and maintain revocation and certificate-status services until certificates expire or are replaced. Affected customers will be offered free replacements through partners, eMudhra said. Its digital-signature, eSign, enterprise PKI and identity services remain unaffected because they use separate infrastructure.
The company gave no date for completing the transition. The Chrome Root Program said an upcoming Chrome Root Store update would remove the upstream eMudhra root, but did not give a date.
