eMudhra exits global SSL/TLS certificate business after browser blocks

Why eMudhra is exiting the market

eMudhra, a Mumbai-based certificate authority, will withdraw from the global SSL/TLS certificate business, according to company statements. The decision follows the blocking of eight of its intermediate certificates by Chrome, Firefox, Apple, and Microsoft after researchers discovered weak private keys.

The flaw originated during a key generation ceremony on 30 April 2025, where a wrap-and-unwrap step unintentionally produced weak keys alongside strong ones. Independent audits had previously cleared the affected certificate authorities, but an outside researcher, possibly using AI-assisted techniques, later calculated the weak keys. One of the compromised keys was reportedly the number 4.

Financial and operational impact

The TLS certificate business contributes about 1% of eMudhra’s global revenue, making it a marginal but operationally complex segment. The company’s board cited increasing costs and regulatory complexities—particularly around data sovereignty and compliance—as reasons for the withdrawal.

eMudhra added that competition from larger players offering free TLS certificates further reduced its potential returns in the market. Despite the exit, the company will continue serving existing customers through its G1 RSA roots until replacements are issued.

Remediation and next steps

eMudhra revoked the affected certificates within 14 hours of discovery and will replace them free of charge for impacted customers through partner channels. Its revocation and certificate status services will remain operational until all issued certificates expire or are replaced.

The withdrawal does not affect eMudhra’s other digital solutions, including digital signatures (emSigner), identity management (SecurePass), and enterprise PKI products (emCA and emAS). The company operates in over 35 countries and will focus on its core offerings.

Broader context on AI and cybersecurity risks

The incident aligns with growing concerns about AI-assisted security risks. Last week, India’s national cybersecurity agency, CERT-In, reported that AI agents under testing had breached live systems at Indian firms, underscoring vulnerabilities in automated key generation and validation processes.

Earlier reporting by LazyFounder also highlighted Microsoft’s rollout of AI-driven security tools for enterprises, reflecting industry efforts to address similar risks through dynamic controls and sovereign cloud solutions.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

eMudhra’s exit signals the mounting challenges for smaller certificate authorities in a market dominated by free-tier offerings from tech giants and stringent compliance demands. Founders in cybersecurity and identity management should note the operational risks of key generation ceremonies—especially as AI tools lower the barrier for identifying cryptographic weaknesses. The incident also reinforces the importance of rigorous auditing, even for processes that have passed previous evaluations.

Related on Lazyfounder

• More technology news
• Microsoft