Cybersecurity firm eMudhra is exiting its global TLS certificate business after a critical security flaw triggered browser distrust. This decision, officially due to a weak private key incident, also stems from the segment's declining commercial viability against free competitors. Over 30,000 existing US certificates were already affected, now requiring transition to new providers.
How We Got Here
The problem started when a researcher discovered weak private keys across eight intermediate CA certificates, prompting Google and Mozilla to distrust eMudhra's certificates. While eMudhra quickly revoked the CAs and claimed no data breach, the board cited the "severe impact" and limited 1% revenue contribution from the segment in its FY26 ₹701.6 Cr revenue.
The Numbers
What Happens Next
eMudhra will transition existing customers to alternative certificate providers free of charge over the next three to four weeks. The company plans to strengthen security controls and refocus on its enterprise business, including areas like AI and quantum computing.
🇮🇳 Why This Matters for India
For Indian cybersecurity startups and enterprises relying on local Certificate Authorities for compliance, this incident highlights the existential risk of reputation and trust in the digital identity sector.
The Take
The market is missing how quickly trust, especially in foundational security services like CAs, becomes binary. Once broken, the reputational hit can force an exit even if the revenue contribution is tiny. Expect other Indian CAs to face increased scrutiny from browser programs and enterprises, pushing for stricter key management audits in the next 12 months.
Source:  Inc42 ↗