--- title: "eMudhra Exits TLS Business After Weak CA Keys | bharat.digital" description: "Browsers distrusted the Bengaluru certifying authority's ECC root within days. In India, a MeitY probe and a CERT-In advisory are so far the only official..." url: "https://bharat.digital/originals/emudhra-exits-tls-weak-ca-keys-chrome-root-removal/index.md" canonical: "https://bharat.digital/originals/emudhra-exits-tls-weak-ca-keys-chrome-root-removal/" published: "2026-10-31T18:10:00+05:30" updated: "2026-10-31T18:10:00+05:30" section: "Originals" type: "startup" author: "bharat.digital desk" image: "https://bharat.digital/img/originals/emudhra-exits-tls-weak-ca-keys-chrome-root-removal-auto-6387206b-og.jpg" language: "en-IN" site: "bharat.digital" --- # eMudhra quits the global TLS business after weak CA keys, but India's accountability questions remain open *Browsers distrusted the Bengaluru certifying authority's ECC root within days. In India, a MeitY probe and a CERT-In advisory are so far the only official responses.* By bharat.digital desk. Startup, Startups & Fintech. Published 2026-10-31T18:10:00+05:30. 2 min read. ![eMudhra quits the global TLS business after weak CA keys, but India's accountability questions remain open](https://bharat.digital/img/originals/emudhra-exits-tls-weak-ca-keys-chrome-root-removal-auto-6387206b-hero.webp) ## At a glance - Company: eMudhra - What it does: Licensed certifying authority selling digital signature certificates, eSign and enterprise signing, identity and certificate management software - Based in: Bengaluru - Latest: Exited global TLS certificate business after weak CA keys - Date: 2026-10-22 On October 27, Chrome stopped trusting emSign ECC Root CA G3, a root certificate run by Bengaluru based eMudhra, which Inc42 describes as India's largest licensed certifying authority. Mozilla had already pulled the same root from its trusted list on October 20. The removals capped a fortnight that began on October 17, when a researcher showed that the private keys of eight eMudhra intermediate certificate authorities were so weak that anyone could work them out from the public certificates. Every key was a number below 256, and one of them was simply 4. Google's Chrome Root Program says it got the report at 18:05 UTC on October 17 and pushed a block to Chrome users within about 1 hour 40 minutes, without needing a browser update. Mozilla, Apple and Microsoft followed, and maintainers of Go, Node.js, Python's certifi bundle and several Linux distributions shipped fixes. eMudhra revoked the eight intermediates on October 18. The company says the keys came out of a single key ceremony on April 30, 2025, where a flaw in one step produced a second, weak set of keys that were then published by mistake. The problem went unnoticed for about 18 months, across two external audit cycles. Google says no website certificate from the affected intermediates had appeared in public Certificate Transparency logs before its block. The root removal hit legitimate customers. The Hacker News, citing Chrome's count, reported about 30,800 unexpired certificates chained to the distrusted root, almost all of them issued through InCommon, the US higher education certificate service. On October 22, eMudhra's board decided to exit the global SSL/TLS certificate business altogether. The company says the line brings in about 1% of revenue, and it reported Rs 701.6 Cr of revenue in FY26, according to Inc42. eMudhra says its digital signature certificate, eSign and enterprise software businesses run on separate infrastructure and are not affected. Inside India, the response has been slower and narrower. MeitY told The Hindu it had set up a special team to investigate and said the impact on Indian websites was very limited, and that DSC and eSign services regulated by the Controller of Certifying Authorities were untouched. CERT-In issued an advisory four days after the report. Inc42's analysis points to the gaps: CERT-In's 2022 directions require listed incidents to be reported within six hours, but its advisory does not say when eMudhra reported; the heaviest lever under the IT Act, licence action, would land on the DSC business that did not fail; and the DPDP Act's breach duties only take effect on May 13, 2027 and cover personal data, which eMudhra says was not accessed. The longer term cost may fall on the country as much as the company. eMudhra was one of the few Indian roots trusted by browsers worldwide, and once its exit is complete, Indian websites will lean almost entirely on foreign certificate authorities for the padlock. It is also not the first time browsers have stepped in: in 2014, after the National Informatics Centre misissued certificates for Google domains, Google restricted the India CCA root to a small set of Indian government domains. eMudhra has told the browser programs it will publish a full root cause report and re verify its other key ceremonies. ## Sources 1. [Inc42: eMudhra Has Quit TLS. The Accountability Questions Haven't](https://inc42.com/features/emudhra-has-quit-tls-the-accountability-questions-havent/) 2. [Google: Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates](https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/) 3. [The Hindu: Eight web security keys of eMudhra firm used by Govt. and PSUs leaked](https://www.thehindu.com/sci-tech/technology/eight-web-security-keys-of-firm-used-by-govt-and-psus-leaked/article71606342.ece) 4. [The Hacker News: eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable](https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html) 5. [CyberScoop: eMudhra kills its certificate business after researchers cracked its private keys](https://cyberscoop.com/emudhra-shuts-down-certificate-business-weak-private-keys/) 6. [eMudhra: Statement on Recent Certificate Security Incident](https://emudhra.com/en/post/certificate-security-incident/) 7. [eMudhra press release: eMudhra to Exit global SSL/TLS Certificate Business](https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business) Written by the bharat.digital desk from the sources above. Figures are as reported by those sources.