Bengaluru-based cybersecurity firm eMudhra has announced its exit from the global SSL/TLS certificate market after a security shortfall in its intermediate certificate authorities led major browsers like Google and Mozilla to distrust its certificates.
- Security flaw in intermediate CA keys caused major browser distrust
- eMudhra to transition customers to alternative providers at no cost
- Company pivots toward AI and quantum computing cybersecurity services
What happened
On October 17, a security researcher revealed that private keys for eight of eMudhra’s intermediate certificate authorities were generated with insufficient randomness, making them vulnerable to recovery. These keys, used to issue digital certificates, raised concerns about potential fraudulent certificate issuance, although no end-entity certificates from the affected intermediates were issued.
Following this revelation, browser root programs including Google and Mozilla responded by distrusting eMudhra’s relevant certificates. In response, eMudhra promptly revoked the compromised certificates within 14 hours and disclosed the incident. Despite no breach of infrastructure or data, the event severely impacted their business operations.
Why it matters
The distrust from major browsers significantly undermined eMudhra’s credibility in the global SSL/TLS market, putting the future of this business segment at risk. The company cited that SSL/TLS certificate issuance constitutes around 1% of its global revenue, with declining returns and rising compliance pressures further reducing its attractiveness.
eMudhra also faces stiff competition from free certificate providers like Let’s Encrypt and upcoming offerings from Cloudflare, compounded by shifting browser policies favoring shorter certificate lifetimes. These factors collectively influenced eMudhra’s strategic decision to exit this market and focus resources on complex customer needs in AI and quantum computing security.
What to watch next
eMudhra has committed to transitioning its existing SSL/TLS certificate customers to alternative providers over the upcoming three to four weeks at no additional cost, aiming to minimize service disruption. The incident affected about 30,000 ECC certificates in the US, which were temporarily migrated to RSA-based certificates prior to this announcement.
Moving forward, attention will focus on how well eMudhra manages this transition and maintains client trust while expanding into advanced cybersecurity domains. The broader certificate authority industry may also watch closely for potential regulatory or operational shifts prompted by this incident.