Certificate Authority eMudhra Exits Global SSL/TLS Market After Key Blunder

Michael Miller · 2026-10-22

So, eMudhra just dropped a bombshell: they're pulling out of the global SSL/TLS certificate business entirely. And the reason? Eight intermediate CA keys that were basically a guessing game away from being compromised. Yeah, that's not the kind of headline any certificate authority wants. ### What Actually Happened Five days before the board's decision, a researcher managed to recover the private keys for eight of eMudhra's intermediate CA certificates. The keys were generated with weak randomness—so weak that they were "easily guessable." In plain English: the digital locks that were supposed to secure countless websites were about as secure as a cheap padlock. Intermediate CAs are the middlemen in the certificate chain. They sign end-entity certificates (the ones on websites), and they're trusted by root CAs. If an intermediate CA's private key is compromised, an attacker could issue valid-looking certificates for any domain. That's a huge deal—it undermines the entire trust model of the web. ### The Fallout eMudhra isn't just quietly fixing the issue; they're exiting the global SSL/TLS market altogether. The company says it will replace affected customers' certificates with free ones from partners. That's a small consolation for businesses that relied on eMudhra for their TLS certs, but it's better than leaving them hanging. > "When your core business is trust, you can't afford to have your keys be guessable. eMudhra's exit is a stark reminder that cryptographic hygiene is non-negotiable." Here's what we know about the replacement plan: - Affected customers will get free replacement certificates from partner CAs. - The transition is expected to happen over the coming weeks. - eMudhra will cease issuing new global SSL/TLS certificates immediately. ### Why This Matters Even If You're Not a Customer You might think, "I don't use eMudhra, so why should I care?" But this incident highlights a broader problem: weak key generation can happen anywhere. If a CA with global reach can make this mistake, others might too. It's a wake-up call for the entire industry to double-check their random number generators. For businesses, it's a reminder to audit your certificate providers. Ask them about their key generation practices. If they can't give you a straight answer, maybe look elsewhere. After all, your website's security is only as strong as the weakest link in the chain. ### What's Next for eMudhra? The company hasn't said much about its future plans beyond the exit. Will they focus on other security services? Will they try to rebuild trust? Only time will tell. But for now, their global SSL/TLS business is done. For the rest of us, it's a cautionary tale about the importance of getting the basics right. In the world of digital certificates, there's no room for guesswork—literally.