Bengaluru — In a decisive strategic shift, Bengaluru-based cybersecurity major eMudhra has announced its voluntary exit from the global Secure Sockets Layer and Transport Layer Security (SSL/TLS) certificate business. The announcement comes directly on the heels of a high-profile security incident that saw browser root programs, including tech giants Google and Mozilla, withdraw their trust in a subset of the company’s digital certificates.

While the company maintains that its core enterprise infrastructure remained uncompromised and no customer data was breached, the fallout from the vulnerability—compounded by a rapidly shifting commercial landscape, mounting compliance costs, and shrinking profit margins—proved decisive. eMudhra’s leadership has confirmed that the organization will now pivot entirely away from public TLS issuance, choosing instead to concentrate resources on high-value, complex enterprise cybersecurity domains such as artificial intelligence (AI) and quantum computing readiness.

Main Facts: The Anatomy of eMudhra’s Exit

The decision to shutter its global TLS certificate operations marks a significant milestone for the publicly listed cybersecurity provider.

• The Core Decision: eMudhra will completely phase out its global SSL/TLS certificate business following a severe security disruption triggered by weak private keys.
• The Root Cause: A security researcher discovered that eight intermediate Certificate Authority (CA) certificates possessed cryptographically weak private keys due to insufficient randomness during generation, making them theoretically vulnerable to reconstruction.
• Browser Retaliation: Major root store operators, notably Google and Mozilla, swiftly moved to distrust the affected certificates, choking eMudhra’s ability to service global TLS clients seamlessly.
• Financial and Strategic Realities: The TLS segment accounted for roughly 1% of eMudhra’s global revenues (against an FY26 financial backdrop of ₹701.6 Cr). Coupled with the rise of free certificate authorities like Let’s Encrypt, anticipated free offerings from players like Cloudflare, and impending global industry standards moving toward stringent 90-day certificate lifespans, the board deemed the return on investment (ROI) unviable.
• Customer Mitigation: The company has committed to migrating existing clients to alternative certificate providers completely free of charge over a strict three-to-four-week transition window.

Chronology of a Crisis: From Discovery to Shutdown

The sequence of events that ultimately forced eMudhra’s hand unfolded rapidly over a matter of weeks, transforming what began as a cryptographic oversight into an existential business review.

April 30, 2025: Generation of the Flawed Certificates

The compromised intermediate CA certificates were initially generated. According to company statements, these certificates subsequently passed through independent audit cycles, successfully evading detection for roughly 18 months despite multiple compliance checks.

October 17, 2025: The Vulnerability is Discovered

Security researcher Wayne formally notified browser root programs and eMudhra that he had successfully recovered the private keys corresponding to eight intermediate CA certificates. The root cause was traced back to a script error and human oversight during the key generation phase, which failed to incorporate sufficient cryptographic randomness. Out of the eight affected intermediates, six were designated for TLS and two for software signing.

Swift Revocation and Initial Damage Control

Upon receiving the disclosure, eMudhra moved quickly, revoking all eight affected intermediate CAs within 14 hours. The company issued public clarifications insisting that none of the compromised intermediates had ever issued end-entity certificates to clients, thereby averting immediate, widespread web spoofing risks. However, the security community remained critical, and the incident sparked fierce debate regarding the efficacy of third-party compliance audits.

The 24–48 Hour Aftermath and Boardroom Realities

Despite proactive remediation, the global fallout intensified rapidly. Major browsers instituted distrust protocols, throwing eMudhra’s international supply chain into disarray. Recognizing the compound risks to its broader enterprise reputation and its fiduciary duties as a publicly traded company, eMudhra’s board convened and made the definitive choice to wind down the TLS division entirely.

Supporting Data and Technical Architecture

Understanding the technical scope of the incident requires examining eMudhra’s cryptographic architecture, specifically its dual-root infrastructure.

The G1 vs. G3 Root Hierarchies

eMudhra operates distinct root certificate hierarchies based on cryptographic algorithms:

• G1 Root Hierarchy: Utilizes traditional RSA cryptography. All certificates issued within India and various adjoining regional markets originate from this root, which remained unaffected by the browser trust revocations.
• G3 Root Hierarchy: Utilizes Elliptic Curve Cryptography (ECC).

Following the security disclosure, Google and Mozilla targeted the G3 ECC intermediate chain as a precautionary measure. This action directly impacted an undisclosed enterprise client in the United States, forcing the abrupt migration of approximately 30,000 active ECC-based certificates over to the G1 RSA root before the final decision to exit the market was made.

Financial Footprint

While eMudhra is widely recognized for its robust digital signature and public key infrastructure (PKI) solutions, the public SSL/TLS certificate segment was a minor contributor to its top line. Generating approximately 1% of the company’s global revenue, the segment offered diminishing returns when weighed against the soaring costs of compliance, infrastructure maintenance, and marketing in a market increasingly dominated by zero-cost alternatives.

Official Responses and Leadership Accountability

Addressing the media and shareholders, eMudhra’s co-founder, Kaushik Srinivasan, offered frank insights into the board’s deliberations and the systemic human errors that allowed the flaw to slip through multiple audit phases.

"The impact has been quite severe over the last 24–48 hours. Given the risk to the rest of the business and our obligations as a publicly listed company, the board felt it was prudent to withdraw from this business," Srinivasan stated in an interview with Inc42.

Addressing the technical breakdown, Srinivasan characterized the incident as an isolated human and scripting error rather than a failure of physical hardware security modules (HSMs).

"It was a script error and a human oversight problem; no hardware problem was found. We will share the facts in due course, and this will also be verified through independent research. It was a one-off, a bad day. That’s exactly what happened."

Srinivasan also emphasized that the company’s strategic withdrawal was not solely a knee-jerk reaction to a single PR crisis, but a calculated pivot driven by macroeconomic shifts within web security.

"The board evaluated the social media reaction, but also took cognisance of the ROI, future potential and competitive landscape," he noted. With entities like Let’s Encrypt providing zero-cost TLS validation and industry regulations aggressively compressing certificate validity windows down to 90 days, Srinivasan noted that the commercial viability of maintaining a proprietary global public TLS operation no longer made economic sense.

Implications for Customers, the Market, and eMudhra’s Future

Immediate Relief for Existing Clients

For active users of eMudhra’s TLS solutions, the primary concern is operational continuity. The company has structured a managed exit strategy, promising to transition all existing clients to alternative, trusted certificate providers completely free of charge over a 3-to-4-week window. By partnering directly with other industry leaders, eMudhra aims to insulate its client base from downtime or unexpected security warnings on their web properties.

Rebuilding Internal Governance and Accountability

In the wake of the audit failures—where the weak key generation script went undetected for 18 months—eMudhra has announced sweeping internal reforms. The company is appointing an independent auditor to compile a comprehensive post-mortem report, expected within two to three weeks.

Furthermore, eMudhra plans to overhaul its internal governance structures by:

• Reinforcing strict maker-checker controls for critical cryptographic ceremonies.
• Mandating deeper independent reviews and adversarial penetration testing for key generation pipelines.
• Exploring the integration of artificial intelligence (AI)-driven compliance and cryptographic auditing tools to automatically flag mathematical anomalies, entropy failures, or human procedural deviations before deployment.

A Strategic Pivot Toward High-Margin Enterprise Solutions

By shedding its public TLS division, eMudhra is effectively trimming its operational fat to double down on its core competencies. The company intends to reallocate engineering talent, compliance budgets, and capital toward high-margin enterprise software solutions, including advanced paperless transformation workflows, enterprise identity access management (IAM), artificial intelligence security frameworks, and future-proofing cryptographic infrastructure for the coming post-quantum computing era.

While the closure marks a humbling end to eMudhra’s journey in public certificate authorities, management remains confident that shedding a low-margin, high-risk commodity service will ultimately fortify the company’s long-term position as a premier enterprise cybersecurity leader.