eMudhra Exits Global TLS Market After 8 Intermediate Keys Are Compromised
Updated
Updated · Computerworld · Oct 23
eMudhra Exits Global TLS Market After 8 Intermediate Keys Are Compromised
3 articles · Updated · Computerworld · Oct 23
Summary
eMudhra said it will leave the global SSL/TLS certificate business after private keys for eight intermediate certificate authorities were compromised, and will shift customers to Sectigo-issued certificates.
Free replacements will be offered through partners or support channels, while eMudhra keeps revocation and certificate-status services running until every certificate is replaced or expires.
Google said Chrome will remove the affected root from its trust store by the morning of Oct. 27 Pacific time, after Mozilla already removed it, forcing operators to install new certificates to avoid outages.
Analysts warned that eMudhra’s remaining G1 roots should be treated only as a bridge because browser scrutiny continues, and that moving to another root under the same company may not resolve trust concerns.
IDC and Azul said browser-side replacement may miss Java keystores, containers, VPNs and embedded devices; Azul released JDK updates blocking the eight affected certificates because Java does not check revocation by default.
Beyond your browser, what hidden enterprise systems are still silently trusting forged certificates from a compromised global authority?
How did a major digital trust company generate keys so weak they could be reverse-engineered directly from public data?
Did rising compliance costs really force this market exit, or was it the ultimate consequence of a catastrophic cryptographic failure?
The eMudhra Key Catastrophe: How an 8-Value Private Key Flaw Forced a Global CA Market Exit and Redefined PKI Security in 2026
Overview
In October 2026, a catastrophic security flaw was uncovered in eMudhra’s certificate authority operations, tracing back to an April 2025 scripting error that generated eight dangerously weak private keys. Human error led to these weak keys being selected for certificate signing, and early warning signs—like invalid CRL signatures—were misdiagnosed and overlooked. When researchers finally exposed the vulnerability, browsers and operating systems rapidly blocked the compromised certificates, but non-browser tools and static trust bundles remained at risk. The crisis triggered regulatory warnings, a sharp drop in eMudhra’s stock, and ultimately forced the company to exit the global SSL/TLS market, prompting industry-wide reforms in certificate authority auditing and key validation.