eMudhra to Exit Global SSL Business After Weak Key Flaw
Browsers blocked eight of its certificate authorities this month.
Key Takeaways
- eMudhra will exit the global SSL and TLS certificate business.
- Weak keys were found in eight intermediate certificate authorities.
- The business is about 1% of eMudhra's global revenue.
- Google plans to remove the related root from Chrome, expected to reach users on 27 October.
- Affected certificates will be replaced free of charge through partners.
eMudhra, the Bengaluru-based digital trust company, will leave the global SSL and TLS certificate business after weak keys were found in eight of its intermediate certificate authorities.
The company's board decided to withdraw. It says the business is only about 1% of its global revenue and that compliance and data sovereignty costs have been rising.
eMudhra at a glance
| Detail | eMudhra |
|---|---|
| What happened | Board decided to exit the global SSL and TLS certificate business |
| Share of revenue | About 1% of global revenue |
| Affected authorities | Eight intermediate certificate authorities |
| Revoked | Within 14 hours of discovery, per the company |
| Chrome root removal | Expected to reach users on 27 October |
| Customer help | Free replacement through partners; Sectigo certificates offered |
How a key flaw cost eMudhra the trust of browsers
eMudhra said a flaw in its key generation ceremony produced a second set of weak keys alongside the strong ones. The weak keys were the ones published to browser root stores. Researchers were alerted on 17 October.
Google and Mozilla blocked the affected certificates. Google also plans to remove the related root from the Chrome Root Store. Google has told website operators with affected certificates to install a new certificate from another issuer straight away.
eMudhra says the affected authorities issued no end-user certificates, and that its infrastructure and data were not compromised.
What eMudhra's exit means for websites using its certificates
Browsers decide which certificate issuers the internet trusts. When a company loses that trust, every site that relies on it has to move. For Indian tech firms, the episode shows how one technical flaw can end a business line within days.
For small business owners with websites, the practical point is to check who issued your website certificate and keep a backup plan if an issuer is distrusted.
What happens to eMudhra's existing certificates
eMudhra says it will publish a root cause report. It will also keep revocation and status services running until all the certificates it issued have expired or been replaced. Customers on its older root will need to move to other issuers over time.