eMudhra exits global SSL/TLS certificate business after security flaw

Indian digital trust provider eMudhra has announced its decision to exit the global SSL/TLS certificate market. The move follows the discovery of a critical security flaw involving eight intermediate Certificate Authority (CA) certificates.

Security researchers identified that the private keys for these certificates were cryptographically weak; while they utilized the NIST P-384 algorithm, the actual key values were integers smaller than 256, making them trivial to recover. This vulnerability could have allowed attackers to impersonate legitimate websites or sign malicious software. In response, major browser and operating system vendors, including Google, Apple, Microsoft, and Mozilla, moved to block the affected certificates.

eMudhra stated that the incident was caused by a script error during a key generation ceremony in April 2025 and involved human error during the packaging process. The company emphasized that the affected TLS business accounts for only approximately 1% of its total revenue and that its core Indian digital signature and eSign services remain unaffected.

Beyond the security incident, eMudhra cited rising compliance costs, increasing operational complexities, and declining commercial viability due to competition from free certificate providers as primary drivers for the strategic withdrawal. The company has committed to working with partners to provide free replacement certificates to affected customers.