Indian trust company eMudhra announced on October 22 that its board decided to pull out of the global SSL and TLS market [2]. The move came after a researcher showed that private keys for eight intermediate certificate authorities had values below 256, allowing anyone to calculate them almost instantly. The company will replace thousands of active eMudhra SSL certificates with credentials from partner authorities as Chrome and Firefox move to block its roots [1].
Discovery of the Flawed Intermediate Keys
On October 17, an independent researcher reported the broken private keys to Apple, Google, Microsoft, Mozilla, and eMudhra. A digital key should be a massive random number, but all eight intermediate keys were smaller than 256. Six of them secured web servers [1].
Security teams at Google and Mozilla acted quickly, blocking the six TLS intermediates in Chrome and Firefox within hours of the alert [1]. eMudhra Chairman V. Srinivasan said the company revoked the flawed keys within 14 hours of discovery. Srinivasan said internal systems suffered no intrusion, all physical and logical controls stayed intact, and eMudhra never used the eight intermediate keys to sign credentials for public websites or users [2].
Google confirmed that no website credentials made by the weak intermediate keys ever appeared in public Certificate Transparency (CT) logs before Chrome introduced its block. Because modern browsers like Chrome require cryptographic logging before accepting an encrypted connection, attackers couldn’t have deployed rogue certificates against users without detection, but the presence of easily guessable signing keys still alarmed root store teams that safeguard the open web. Chrome and Mozilla enforce strict root standards. Any flaw that makes signing keys guessable breaks user trust, prompting browser maintainers to question how eMudhra created its keys [1].
How eMudhra SSL Certificates Affect Campuses
The fallout hit American higher education through InCommon. The higher education trust network InCommon, originally created by Internet2, moved its certificate operations onto eMudhra’s CertiNext platform between April and July 2026. When Google inspected Certificate Transparency logs on October 21, its team discovered about 30,800 unexpired server credentials chained to eMudhra’s emSign ECC Root CA – G3, with Chrome data showing that 99.9% of those certificates had been issued through InCommon. Hundreds of campus domains face browser warnings unless administrators replace their credentials [1].
Cornell University counted more than 300 affected certificates on campus machines. Cornell told system administrators to switch to RSA keys from eMudhra’s older root, which is still trusted for now. The University of Michigan gave similar advice but warned that the RSA root might also face removal, pointing to Let’s Encrypt as a dependable alternative [1].
Migrating thousands of active eMudhra SSL certificates before browser deadlines requires coordinated effort within campus IT departments. eMudhra estimated that around 30,000 keys need replacement, with about 97% of them having been issued through the Automated Certificate Management Environment (ACME) protocol. Google warned that standard ACME automation won’t renew credentials ahead of schedule unless operators trigger updates by hand or use tools that support ACME Renewal Information (ARI). Switching from elliptic curve cryptography to RSA keys also calls for manual changes in server settings [1].
Browser Deadlines in Chrome and Firefox
Browser vendors set rapid enforcement schedules to protect web users. Mozilla decided on October 20 to stop trusting the emSign ECC Root CA – G3 root in upcoming releases of Firefox. Google set a tighter deadline for Chrome, scheduling trust removal for the morning of October 27, Pacific time [1].
Public web browsers maintain root stores to ensure every encrypted session connects to an authentic endpoint. The overall structure of digital trust relies on strict public key validation, a subject examined in our guide to Merkle tree certificates for Web PKI. Because dropping a root breaks every intermediate and server credential chained beneath it, Google warned site owners that they must get fresh TLS credentials from another provider included in the Chrome Root Store [1].
The approaching October 27 Chrome deadline leaves university administrators with little time to replace expiring keys. While eMudhra promised to work with browser programs to help customer transitions, Chrome users visiting domains secured with eMudhra SSL certificates after Monday morning will encounter security warning screens. Many campuses spent the weekend conducting audits of their web infrastructure, scanning load balancers, institutional portals, and internal research endpoints to detect any keys still chained to the G3 root. Campus teams worked long hours to prevent outages [1].
Replacing Active eMudhra SSL Certificates
In its official statement from Bengaluru, eMudhra promised to replace affected credentials free of charge through partner authorities [2]. The company didn’t name the partner authorities or set a firm date for concluding its exit [1]. Status services will run until all existing keys expire or get replaced [2].
eMudhra said global SSL and TLS products account for only about 1% of its revenue [1, 2]. Chairman Srinivasan said climbing compliance rules and data sovereignty laws made the public certificate business increasingly costly to operate, while major automated providers offer free credentials to the public and shrink returns for commercial vendors. Social media attention grew out of proportion to SSL’s small financial role [2].
The company stressed that its primary enterprise products will continue normal work without interruption. Listed in India under ticker symbols (BSE: 543533 | NSE: EMUDHRA), eMudhra has provided digital trust services for more than 17 years across 35 countries. Its product lineup includes the CertiNext PKI platform, emCA, SecurePass identity tools, PrivaTrust data discovery software, and the emSigner signature suite. Domestic Indian digital signature certificates (DSC), eSign, and emAS authentication services remain unaffected because they run on separate systems from the global SSL network. By dropping public SSL certificates, eMudhra plans to focus resources on its core enterprise trust products [2].
Questions Around the RSA Root
eMudhra urged customers to adopt its G1 RSA root hierarchy as an interim solution. Mozilla agreed on October 20 to retain trust in emSign Root CA – G1 for now. Chrome engineers haven’t decided whether they will keep eMudhra’s remaining roots in the Chrome Root Store [1].
New complications arose when eMudhra published a certificate revocation list (CRL) on October 14 for emSign Root TLS CA – G1, an intermediate used by Stanford University. A researcher reported on Mozilla’s bug tracker that the list’s digital signature didn’t verify against the CA’s own public key. On October 22, a participant in the bug report said that the file had been signed with the private key of an eMudhra Online Certificate Status Protocol (OCSP) responder. The participant called this an administrative mistake involving the wrong signing key rather than evidence of another weak key pair [1].
Chrome engineers submitted 12 pointed questions to Mozilla’s bug tracker on October 21 regarding eMudhra’s key controls. The inquiry asked eMudhra to identify which key signed the flawed revocation list and whether the company holds duplicate key pairs for any of its root or intermediate authorities. Similar trouble surfaced in 2025, when eMudhra generated invalid revocation lists for six intermediate authorities. eMudhra admitted on October 19 that those 2025 lists had been resigned using the flawed keys discovered this month. Google stated that this delayed admission raises serious concerns about eMudhra’s transparency and incident handling, noting that eMudhra had not publicly answered Chrome’s 12 questions by Thursday afternoon [1].
- ONLINE NEWS The Hacker News. (2026, October 22). eMudhra to exit global SSL/TLS business after 8 intermediate CA keys found easily guessable. [Article Link]
- PRESS RELEASE eMudhra Limited. (2026, October 22). eMudhra to exit global SSL/TLS certificate business. [Article Link]
