Indian digital trust company eMudhra has decided to withdraw from the global SSL/TLS website certificate business after a cybersecurity incident exposed weaknesses in cryptographic keys linked to eight intermediate certificate authorities. Co-founder Kaushik Srinivasan has attributed the problem to a software script error combined with inadequate human oversight, describing it as an isolated incident.
The decision marks a change in the company’s international operations as it seeks to address security concerns, manage customer transitions and concentrate on other digital security services.
How the Security Flaw Occurred
According to Srinivasan, the problem originated during a cryptographic key-generation process conducted on April 30, 2025. The procedure included an additional step to export and import keys for the company’s international operations. An error in the script used for that process resulted in keys with insufficient cryptographic randomness.
Such keys are intended to protect digital certificates that help browsers verify website identities and establish secure connections. If private keys can be predicted or reconstructed, they may create a risk of fraudulent certificates being generated.
The weakness reportedly remained undetected for approximately 18 months, despite the process undergoing external audits. The incident has raised questions about the effectiveness of the company’s internal checks and the safeguards used during sensitive cryptographic operations.
Company Plans Independent Investigation
eMudhra has said it will appoint an independent auditor to examine the incident, including its key-generation procedures and related security controls. The company has indicated that it intends to make the findings public after the review.
It is also considering additional safeguards, including stronger maker-checker procedures, independent review at critical stages and automated checks designed to identify irregularities during key generation.
The company has said it found no evidence that the affected keys were exploited. It has also stated that the incident did not involve a breach of its infrastructure or a data leak. These claims will be important areas for further scrutiny as the independent investigation proceeds.
The affected intermediate certificate authorities were revoked within 14 hours of the issue being discovered, according to the company. The incident nevertheless triggered broader concern within the digital certificate ecosystem because website certificates depend on reliable cryptographic protection.
Why eMudhra Is Leaving the Business
Srinivasan said the security incident accelerated a decision that the board had already been considering. The global SSL/TLS certificate business contributes approximately 1% of eMudhra’s overall revenue, while compliance requirements, operating costs and competition from providers offering certificates at no charge have made the segment less commercially attractive.
The company expects the incident and its aftermath to affect overall revenue by around 5% to 7% over the next one or two quarters, according to Srinivasan. The precise sources of that projected impact have not been fully detailed.
eMudhra intends to focus more heavily on enterprise security and digital trust services where it sees stronger long-term opportunities.
What Happens to Existing Customers?
The company has committed to helping affected customers move to alternative certificate providers and replacing certificates through partners without charging customers for the transition. It plans to coordinate with customers and browser programmes to reduce disruption while outstanding commitments are completed.
The company has also stressed that its Indian digital-signature services, eSign operations and other enterprise solutions run on separate infrastructure and are not affected by the reported incident.
The coming independent review will be significant for establishing the precise causes of the weakness and assessing whether existing safeguards need further changes. For eMudhra, restoring confidence will depend not only on completing the withdrawal from global SSL/TLS certificates but also on demonstrating that stronger controls are in place across its remaining operations.
