eMudhra to exit global SSL/TLS certificate business
After an incident with its certificate authorities, the Indian trust company says it will withdraw from public TLS certificates.
eMudhra, an Indian digital trust company, announced on 22 October 2026 that its board has decided to voluntarily withdraw from the global SSL/TLS certificate business.
What eMudhra says
The company pointed to a recent incident involving its global SSL/TLS certificate authorities. It says it revoked the affected CAs within 14 hours of discovery, that no end-entity certificates were issued from them, and that its infrastructure wasn’t compromised. It says SSL/TLS is about 1% of its global revenue. It also said social media scrutiny of the incident was “out of proportion” to that business’s size. In a separate report shared widely the same week, a researcher claimed a full bypass of eMudhra’s OTP login.
Transition
eMudhra says its G1 RSA roots will keep working during the transition, and that it will contact affected customers to replace their certificates free of charge through partners. It also says it will publish a full root-cause report for the browser root programs.