On October 22, 2026, eMudhra announced that its board had decided to withdraw voluntarily from the global SSL/TLS certificate business. The company outlined a customer transition plan: G1 RSA roots would continue serving customers, affected customers would be offered free replacement certificates through partners, and revocation and certificate-status services would continue during the transition.
What eMudhra said customers can expect
Under the plan, eMudhra said it would contact affected customers and arrange replacement certificates through partners at no charge. It also said it would keep revocation and certificate-status services running until issued certificates expired or were replaced.
The announcement describes a transition, rather than a completed withdrawal. For related customer context, see NeoTeo’s earlier coverage of eMudhra’s Sectigo certificate alternative.
Eight affected intermediates, with two certificate purposes
An intermediate certificate authority (CA) can issue certificates used by websites or software publishers. Mozilla’s incident record identifies eight affected intermediates: six for TLS and two for code signing. The incident therefore involved both website-security certificates and certificates used to sign software.
Mozilla said it independently recovered the affected P-384 private keys on October 17, 2026. P-384 is an elliptic-curve cryptography standard; Mozilla’s record says each affected private value was an integer below 256.
eMudhra’s preliminary account of the weak keys
In its preliminary explanation, eMudhra said a flaw in a key-generation ceremony produced weak keys alongside the intended keys. Similar labels led staff to use the weak keys in certificate signing requests. The company said it was still investigating the root cause.
Why eMudhra says it is leaving
eMudhra said SSL/TLS accounted for about 1% of its global revenue. The company also cited growing data-sovereignty and compliance requirements, rising complexity and costs, free certificate offerings, and scrutiny after the incident as reasons for the withdrawal decision.
The company said its separate digital-signature, eSign, enterprise PKI, eSignature, identity, and authentication services, including operations in India, were unaffected by the global SSL/TLS issue.
