eMudhra Exits Global SSL/TLS Market After Private Key Leak

Indian Certificate Authority (CA) eMudhra announced on October 22 that its board decided to voluntarily exit the global SSL/TLS certificate business.

The decision follows a security incident disclosed five days earlier by Mozilla researcher Dennis Jackson, who reported that the private keys of eight eMudhra intermediate CA certificates had been cracked and leaked online. Six of these certificates were used for website (TLS) certificates.

In response, Google Chrome will stop trusting the upstream eMudhra root certificate emSign ECC Root CA - G3, with the change expected to take effect on October 27 (Pacific Time). Mozilla similarly decided on October 20 to stop trusting the same root certificate in Firefox, which also cuts off access to all valid certificates issued under that hierarchy.

According to Chrome's public Certificate Transparency (CT) logs, as of October 21 there were approximately 30,800 unexpired certificates under the affected root. 99.9% of these certificates were issued through InCommon, the certificate service created by Internet2 for higher education. InCommon had migrated its service to eMudhra's CertiNext platform between April and July of this year.

Google has notified website operators holding certificates under this root that they "must immediately obtain and install new TLS certificates from another PKI hierarchy included in the Chrome root store."

eMudhra stated that its G1 RSA root certificate will continue to serve customers during the transition. The G1 root belongs to a separate hierarchy from the ECC root, but Chrome is still deciding whether to retain eMudhra's remaining CA certificates in its root store. The company will continue to provide revocation and status checking services until all its issued SSL/TLS certificates have either expired or been replaced.

Other eMudhra businesses — including digital signature certificates, eSign, the CertiNext platform used by InCommon, enterprise PKI solutions (emCA, CertiNext), the emSigner e-signature suite, and identity authentication solutions (SecurePass, emAS) — remain unaffected and will continue normal operations.

eMudhra's president noted that the global SSL/TLS business accounted for roughly 1% of the company's revenue. Data sovereignty and compliance requirements have made operations increasingly complex and costly, while some large providers offer certificates for free. The incident also attracted "disproportionate scrutiny relative to the position of SSL/TLS in our business."

For existing customers, the primary alternative is Let's Encrypt. eMudhra emphasized that its global SSL/TLS infrastructure is completely isolated from its other operations.

The company, with a 17-year history serving BFSI clients in over 35 countries, will now focus entirely on enterprise core solution services.

Related reading: Oracle emergency Java security alert (CVE-2026-91403) blocking eMudhra weak private key certificates; Cloudflare joins free SSL certificate offerings; Let's Encrypt launches six-day short-lived TLS certificates and IP address certificates.