eMudhra exits global TLS certificate business following security vulnerability
Bengaluru-based eMudhra has ceased its global TLS certificate operations after a critical flaw in its key generation process prompted major browser vendors to revoke trust.
In late October, Google and other major browser developers revoked trust in eMudhra’s emSign ECC Root CA – G3, causing security warnings for websites relying on the provider. The move followed revelations that the company’s private keys were generated with such low entropy that they were cryptographically insecure, stemming from a flawed key ceremony held in April 2025.
Browser makers, including Google, Mozilla, Apple, and Microsoft, acted within hours of the disclosure to protect users by blocking the affected certificates. While eMudhra maintains that the TLS segment accounted for roughly 1% of its total revenue, the board moved to exit the business line entirely within five days of the report. Cofounder Kaushik Srinivasan described the failure as a "one-off" event that managed to bypass two separate audit cycles.
Indian authorities, including the Ministry of Electronics and Information Technology and CERT-In, have since launched an investigation into the incident. As the company retreats from the TLS market, regulatory scrutiny remains regarding oversight and accountability for certificate authorities operating within the Indian financial and government sectors.