eMudhra Exits Global SSL/TLS Business After Weak Key Incident
Indian digital trust firm eMudhra is voluntarily exiting its global SSL/TLS certificate business, which generates roughly 1% of its revenue. The decision follows a recent incident where eight intermediate certificates were found to have weak private keys, prompting major browsers to block them. The company cites rising compliance costs and free competition as primary drivers, aiming to refocus on core enterprise solutions.
Key points
- eMudhra Limited, an Indian digital trust company, announced its board decision to voluntarily withdraw from the global SSL/TLS certificate business on October 22, 2026.
- The move follows the discovery that eight intermediate certificates possessed weak private keys, one of which was the number 4, leading Chrome, Firefox, Apple, and Microsoft to block them.
- Chairman V. Srinivasan stated that the affected certificate authorities issued no end-entity certificates and that the infrastructure remained uncompromised, with revocation completed within 14 hours of discovery.
- The SSL/TLS segment contributes approximately 1% of eMudhra's global revenue, a figure the company argues is disproportionate to the scrutiny generated by the incident on social media.
- Rising data sovereignty and compliance costs, combined with large competitors offering certificates for free, reduced the return on investment for this specific business line.
- eMudhra plans to sharpen its focus on core enterprise solutions and trust services other than SSL/TLS to optimize its cumulative revenue base.
eMudhra Limited, a global digital trust company headquartered in Bengaluru, has announced that its board of directors has voted to voluntarily withdraw from the global SSL/TLS certificate business. The decision, disclosed on October 22, 2026, comes days after major web browsers blocked eight of the company’s intermediate certificates due to a cryptographic flaw. The move signals a strategic pivot for the Indian firm, which will now concentrate its resources on core enterprise solutions and other trust services.
The catalyst for the exit was the discovery that the private keys for eight intermediate certificates were weak enough to be easily calculated, with one key being the number 4. This flaw, traced to a key generation ceremony on April 30, 2025, resulted in Chrome, Firefox, Apple, and Microsoft blocking the affected keys. eMudhra Chairman V. Srinivasan noted that the company revoked the affected certificate authorities within 14 hours of discovery and that no end-entity certificates were issued from those authorities, meaning direct impact on end-users was minimal.
While the technical incident provided the immediate impetus, Srinivasan emphasized that structural market factors played a significant role in the decision. The SSL/TLS segment accounts for only about 1% of eMudhra’s global revenue. The company argued that increasing data sovereignty and compliance requirements have made the business more complex and costly to maintain. Furthermore, the entry of large competitors who issue certificates for free has eroded the potential return on investment for eMudhra. The company stated that the social media amplification of the weak-key incident brought scrutiny that was out of proportion to the segment's actual contribution to its overall business model.
Sources
The WireByte editorial team synthesises technology news from multiple primary sources, verifies the facts, and links every source. Articles are produced with AI assistance and reviewed under our editorial policy.
