Certificate Authority eMudhra to Exit SSL/TLS Certificate Business Following Private Key Issue; Existing Customers' Certificates to Be Replaced Free of Charge

What happened

On October 22 (local time), eMudhra announced it will voluntarily leave the global SSL/TLS certificate business. The decision came after researchers found that the signing keys for eight intermediate certificates run by its certificate authority could be easily recovered by third parties. Major browser and tech makers, including Mozilla, Google, Apple, and Microsoft, quickly blocked the affected certificates. Mozilla and Google also said they would revoke trust in the higher-level root certificate, "emSign ECC Root CA - G3."

Key numbers and facts

• The problem was reported by researchers on October 17, 2026.
• eMudhra revoked the affected certificate authority within 14 hours of discovering the problem.
• The global SSL/TLS business makes up about 1% of eMudhra's sales.
• eMudhra says no website certificates were issued from the affected authority, and there was no break-in or data leak.

Background: what is an SSL/TLS certificate?

An SSL/TLS certificate is a digital ID for a website. It helps your browser check that a site is real when you use HTTPS, the secure version of the web address. A certificate authority (CA) is the company that issues these IDs. Keeping the private key secret is very important, because whoever has it can pretend to be the real site.

Why it matters

eMudhra said the business had become costly and hard to manage. Rules about where data is stored and legal compliance were getting stricter every year. Large providers also give certificates away for free, so profits fell sharply. Because the problem spread widely on social media, the company decided to exit. Existing customers will be contacted directly and given free replacement certificates from partner companies. Other products, such as digital signature services and certificates for use in India, are not affected.

What to watch

• Whether affected companies switch to new certificates from other providers on time.
• Whether eMudhra completes the handover before its older "G1" root certificate system is retired.
• Whether eMudhra submits the full root-cause report that browser makers have asked for.
• How the exit affects trust in other small certificate authorities.