eMudhra to exit global SSL/TLS certificate business after CA incident
On October 22, 2026, eMudhra Limited, a Bengaluru-based digital trust company listed on BSE and NSE, announced in a press release that its Board has decided to voluntarily withdraw from the global SSL/TLS certificate business. The decision follows what the release calls a recent incident relating to its global SSL/TLS certificates.
Chairman V. Srinivasan, as reported in the release, said eMudhra handled the incident diligently. The company says it revoked the affected CAs within 14 hours of discovery and disclosed the incident promptly. It also says no end entity certificates were issued out of the affected CAs, its infrastructure was not compromised, no data was breached, and all physical and logical security controls remained intact.
The release gives several reasons for the exit. Global SSL/TLS is described as a small part of the business, contributing about 1% of global revenue. Data sovereignty and compliance requirements are making the business more complex and costly each year. Some large entities issue SSL/TLS certificates free of cost, which the company says has considerably reduced the business potential and return on investment of this line against its cumulative revenue base. The company also says social media amplification of the incident has brought scrutiny out of proportion to the place SSL/TLS holds in its business. After detailed deliberations, the Board concluded that withdrawing is the right decision for eMudhra and its shareholders. The release adds that for many certifying authorities SSL/TLS is the whole business, while for eMudhra it is one part of a much broader portfolio, and that the company will focus on core enterprise solutions and trust services other than SSL/TLS.
On the transition, eMudhra says its G1 RSA roots will keep serving customers until the transition is complete, while it works with browser programs and customers. It will reach out to affected customers to replace any certificate free of cost from partners. Revocation and certificate status services will keep running until every issued certificate has expired or been replaced. The company will also complete its remaining commitments to the browser root programs, including a full root-cause report.
The global SSL/TLS infrastructure, the release says, runs separately from the rest of the company. Global digital signature certificates (DSC), eSign and other signing services including those in India, the enterprise PKI products emCA and CertiNext, the emSigner eSignature suite, and the identity and authentication products SecurePass and emAS are described as unaffected and operating as normal. The release describes eMudhra as having over 17 years of expertise and serving banks and financial institutions, enterprises and governments in more than 35 countries.
Key facts
- eMudhra's Board has decided to voluntarily withdraw from the global SSL/TLS certificate business, announced October 22, 2026 following a recent incident involving its global SSL/TLS certificates.
- The company says it revoked the affected CAs within 14 hours of discovery, that no end entity certificates were issued from them, and that its infrastructure was not compromised and no data was breached.
- eMudhra says global SSL/TLS contributes about 1% of its global revenue, and cites rising data sovereignty and compliance costs and free SSL/TLS from large entities as reasons for the exit.
- G1 RSA roots will keep serving customers during the transition; affected customers will get free replacement certificates from partners, and revocation and status services will run until all issued certificates expire or are replaced.
- Global DSC, eSign, emCA, CertiNext, emSigner, SecurePass and emAS are stated to be unaffected.
Why it matters
A certificate authority leaving the public SSL/TLS market after an incident is a notable event for web trust infrastructure. eMudhra frames the exit as a business decision: the line is about 1% of revenue and, in the company's words, the scrutiny it drew was out of proportion to that share. The release also names economics as a driver, with compliance and data sovereignty costs rising and some large entities issuing SSL/TLS free of cost.
Who it affects
Holders of eMudhra-issued SSL/TLS certificates are the directly affected group; the company says it will contact them and replace certificates free of cost through partners. The browser root programs are also involved, since eMudhra says it is working with them on the transition and will complete its remaining commitments, including a full root-cause report. The company says customers of its signing, enterprise PKI and identity products are not affected.
How to use it
This is an announcement, not a product. Customers with eMudhra SSL/TLS certificates should expect outreach from the company about replacements, which it says will come free of cost from partners. The release says G1 RSA roots keep serving customers until the transition is complete, and that revocation and certificate status services continue until every issued certificate has expired or been replaced.
How solid is it
The source is eMudhra's own press release, so the account of the incident, the 14-hour revocation, the absence of compromise and the 1% revenue figure are the company's claims. The release does not describe the nature or cause of the incident, does not name the affected CAs or give their count, and gives no date or timescale for completing the exit or the customer transition. It does not name the browser programs or mention any browser distrust or root-removal action.
Risks and caveats
Several open questions remain. The release gives no number of affected customers or certificates, does not name the replacement partners, and gives no details of what the social media amplification consisted of. The full root-cause report is promised but not yet published. Until it appears, the claims about what went wrong, and what did not, rest on the company's summary alone.
“For many certifying authorities, SSL/TLS is the whole business. For eMudhra it is one part of a much broader digital solutions portfolio.”
— eMudhra press release, October 22, 2026