Indian authority eMudhra exits the global certificate sector following severe key flaws

India-based certification authority eMudhra announced on Thursday that its board decided to withdraw completely from the global SSL/TLS certificate market. The exit follows revelations that the company issued eight intermediate certificate authority credentials with trivial private encryption keys, one of which was merely the single digit 4. The flawed keys, which ranged in value from 4 to 237, theoretically allowed anyone to mint trusted certificates for arbitrary websites and mail servers. [1][2]

The company attributed the lapse to a wrap/unwrap flaw during a key generation ceremony that accidentally published weak keys to browser root stores alongside strong ones, despite passing independent audits since mid-2025. eMudhra stated that the affected intermediate authorities never issued end-entity certificates and were revoked within 14 hours of discovery. To ensure an orderly wind-down, eMudhra pledged to maintain its G1 RSA roots, status, and revocation services until existing certificates expire, offering to transition customers to alternate providers at no cost. [2]

Chairman V. Srinivasan and company leadership noted that global certificates accounted for only about 1 percent of overall revenue. Facing mounting compliance overhead, data sovereignty mandates, and competition from free providers, the firm determined that the intense online backlash and public scrutiny outweighed the division's minimal financial returns. [1][2]