Emudhra Exits TLS After Misusing a Certificate’s Private Key

WHO:

Ars Technica - eMudhra, described as a digital trust services provider, is exiting the TLS business.

Reuters, via Techmeme - Indian digital trust services provider eMudhra (EMUD.NS) said it would voluntarily withdraw from the global SSL/TLS certificate business.

WHAT:

Ars Technica - eMudhra is dropping out of the TLS business after misuse of a certificate’s private key.

Ars Technica - A flawed key-signing “ceremony” allowed web credentials to be minted for any site.

Reuters, via Techmeme - eMudhra said it would exit the SSL/TLS certificate business.

Reuters, via Techmeme - eMudhra’s TLS certificates had private keys of just 3 to 8 bits that were compromised.

Reuters, via Techmeme - The SSL/TLS certificate business accounted for 1% of eMudhra’s revenue.

WHY:

Ars Technica - The exit followed misuse of a certificate’s private key and a flawed key-signing ceremony that enabled credentials to be created for any site.

Reuters, via Techmeme - eMudhra linked its decision to compromised TLS certificates with private keys of 3 to 8 bits.

(UPDATED October 22, 2026 22:14 UTC)

Indian digital trust provider eMudhra is voluntarily exiting the global SSL and TLS certificate business after its certificates were compromised. The company said the affected certificates had private keys only 3 to 8 bits long, making them vulnerable to misuse. The incident also involved a flawed key-signing ceremony, which allowed credentials to be created for any website. That raised a serious concern because SSL and TLS certificates help establish secure connections and verify that websites are genuine. eMudhra’s decision follows the misuse of a certificate’s private key, and the company linked its withdrawal directly to the compromised certificates. The certificate business accounted for about 1 percent of eMudhra’s revenue. The company is therefore giving up a relatively small part of its business as it exits the global market for these certificates.