eMudhra exits global website certificate business after script error creates weak keys

Bengaluru-based digital security firm eMudhra has decided to voluntarily exit the global website security certificate business, following an internal script error that generated weak cryptographic keys in eight intermediate authorities.

The company announced the withdrawal after major web browsers, including Google, Apple, Microsoft, and Mozilla, suspended trust in its ECC Root G3 certificate authority. The issue arose from eight intermediate certificate authorities generated during a key ceremony on 30 April 2025, where human error in executing an automation script truncated key lengths.

Dennis Jackson, a member of Mozilla's cryptography engineering team, flagged the vulnerability on 17 October. eMudhra revoked the affected authorities within 14 hours of notification. The company stated that none of the eight intermediate authorities had been put into active production and no customer-facing website certificates were ever issued through them.

Domestic digital systems fully protected

The Union Ministry of Electronics and Information Technology (MeitY) and the Indian Computer Emergency Response Team (CERT-In) stepped in immediately to inspect eMudhra's setup. Following an on-site review by officials, MeitY confirmed that the incident had a "very limited and for a very short interval" impact on domestic websites and cautioned against social media alarmism.

Crucially, India's sovereign digital identity framework and critical citizen platforms remain fully protected. eMudhra's core domestic operations—such as digital signature certificates and e-sign services used across Aadhaar, the Income Tax portal, GST networks, and major enterprises such as Infosys and TCS—run on completely isolated network infrastructure.

Board shifts focus to enterprise security

The global SSL/TLS certificate line represented only about 1% of eMudhra's revenue. Co-founder Kaushik Srinivasan noted that the board decided to withdraw because escalating global compliance costs, shortening certificate validity windows, and aggressive price competition made the international line commercially unviable relative to the intense scrutiny it attracted.

eMudhra's shares fell 36% over two trading sessions, closing at ₹345 on the BSE as markets digested the development. Chairman V. Srinivasan confirmed that the firm suffered no external data breach or server compromise, with physical and logical data centre controls remaining unbreached.

To restore market certainty, eMudhra has commissioned an independent audit by an empanelled firm to inspect its cryptographic key inventories and generation workflows, promising to publish the full findings. Around 30,000 certificates connected to the G3 root are being transitioned to alternative trust providers free of charge, while the older G1 RSA root continues to operate until migrations finish.