In the quiet machinery of the internet, few companies matter more than certificate authorities. They are the institutions whose digital signatures tell your browser that the website on your screen is genuinely who it claims to be, and that the connection between the two of you cannot be eavesdropped upon. Last week, one of India's own certificate authorities, the Bengaluru-based eMudhra, suffered a failure in the very foundation of that trust.
On Thursday, its board decided to walk away from the global website-certificate business altogether.
The trigger for the decision was a security disclosure that began on October 17. A security researcher reported to eMudhra that he had recovered the private keys of eight of the company's intermediate certificate-authority certificates. According to Google's account of the incident, those keys were generated with insufficient randomness during a key-generation ceremony held on April 30, 2025.
In practical terms, that means the secret numbers at the heart of the keys were far too easy to guess, allowing the researcher to recover them — a condition that, had they fallen into malicious hands, could have permitted the impersonation of websites and the issuance of fraudulent secure certificates.
eMudhra moved quickly once it knew. The company's chairman, V Srinivasan, said the affected certificate authorities were revoked within fourteen hours of the discovery of the problem. The company also stated that the weak keys were never used to issue certificates to any websites or end users, and that none of its infrastructure had been breached. The flaw, it said, was confined to the key-generation ceremony itself.
That explanation, however, was not enough to preserve the trust of the world's major browser vendors. On October 20, Mozilla decided it would stop trusting the root certificate sitting above the compromised intermediates — the emSign ECC Root CA - G3 — in Firefox. Google's Chrome programme followed, announcing that it would stop trusting the same root, with the change expected to reach Chrome users on the morning of October 27 Pacific time.
When browsers stop trusting a root, every website certificate chaining up to it is treated as suspect, and visitors begin to see warnings instead of web pages.
The scale of the exposure is significant. As of October 21, Chrome's programme counted about 30,800 unexpired certificates chained to the distrusted root in the public Certificate Transparency logs. The vast majority of those — 99.9 per cent — were issued through InCommon, the Internet2 certificate service that serves the higher-education community, including universities and research institutions.
InCommon had moved onto eMudhra's CertiNext platform between April and July this year, which is how such a large number of academic certificates came to depend on the Indian company's infrastructure.
Against that backdrop, the board's decision to exit the business becomes understandable. Srinivasan said the scrutiny that followed the incident had influenced the board's thinking. The SSL/TLS certificate business, he added, accounts for around one per cent of eMudhra's global revenue — a small slice, but one that carries the kind of reputational risk a trust business cannot afford.
The company will now shut down its global website-certificate operations in an orderly fashion rather than attempt to rebuild the trust it has lost.
There is a transition plan for the customers left holding certificates chained to the distrusted root. eMudhra says it will replace affected customers' certificates with free certificates from partner providers, though it has not named those partners.
It will also keep its revocation and certificate-status services running until every SSL/TLS certificate it has issued has either expired or been replaced, so that browsers can continue to check whether a certificate has been withdrawn. Until that transition is complete, the company's separate G1 RSA root hierarchy — distinct from the distrusted ECC root — continues to serve customers, while Chrome weighs whether to keep eMudhra's remaining CA certificates in its root store.
What this incident leaves behind is a textbook lesson in what certificate authorities actually do, and why their keys matter so much. Every time you visit a website over HTTPS — the padlock in your browser's address bar — your browser is relying on a chain of digital signatures.
The website presents a certificate proving its identity; that certificate is signed by an intermediate certificate authority; and that intermediate is in turn signed by a root authority whose key is pre-installed in your browser. If the root or intermediate key is compromised, an attacker could sign a certificate for any website in the world — your bank, your university, your government portal — and your browser would accept it as genuine.
Both Google and Mozilla treated that risk as decisive here, moving to distrust the root even though eMudhra says the weak keys were never exploited.
For eMudhra itself, the exit from the global SSL/TLS market is not the end of the company. Its other businesses continue: digital signature certificates for individuals and enterprises, the eSign service widely used for paperless transactions in India, and the CertiNext platform that provides managed public-key infrastructure to organisations. Those lines of business do not depend on the distrusted root, and the company has made clear they will carry on.
Still, the episode will be studied for years in the tight-knit world of internet trust. Certificate authorities occupy a peculiar position: they are largely invisible when they work, and catastrophic when they fail. A key-generation ceremony — the formal, witnessed process by which a CA creates its most sensitive secrets — is supposed to be the most carefully guarded moment in a CA's life.
That a ceremony could produce keys weak enough to be recovered by an outside researcher, and that the weakness could go unnoticed for nearly eighteen months, raises uncomfortable questions about the auditing and oversight regimes that govern the industry.
India has been building a name for itself as a supplier of digital-trust infrastructure to the world, and eMudhra has been one of the standard-bearers of that ambition. The company's retreat from the global website-certificate market is a setback for that project — but also, perhaps, a demonstration of how the system is supposed to work. Certificate Transparency logging caught the scope of the exposure.
Browser vendors acted on the evidence. And the company, rather than fighting to hold onto a business whose foundation had cracked, chose to close it. The internet's trust fabric held, not because nothing went wrong, but because the mechanisms for dealing with failure did their job.
(Reporting based on The Hacker News and Business Today.)