Indian digital security firm eMudhra is exiting its global SSL/TLS certificate business after a cryptographic weakness prompted Google, Apple and Microsoft to withdraw trust in its certificates, sending the company’s shares sharply lower.

The Bengaluru-based company announced the decision on Thursday, 22 October, after a software error was found to have weakened eight intermediate certification authority certificates generated in April 2025.

The error produced cryptographic keys shorter than intended, making them potentially easier for attackers to crack. The weakness went undetected for about 18 months despite the company passing two rounds of security audits.

eMudhra said the affected certificates had been revoked and maintained that its infrastructure had not been breached or customer data compromised.

The company is withdrawing from a business that contributes about 1% of its revenue but operates within the trust infrastructure used to secure websites, online transactions and digital communications worldwide.

How the security lapse went undetected

SSL/TLS certificates allow browsers and other applications to verify website identities and establish encrypted connections. They are widely used by banks, e-commerce platforms, government agencies and businesses.

The system relies on trusted certificate authorities, which issue digital credentials confirming that websites and services are legitimate. Intermediate certification authorities operate beneath trusted root authorities and can issue certificates within that trust hierarchy.

A weakness in an intermediate authority’s private key can have consequences beyond any individual website. If attackers manage to reconstruct or obtain the key, they could potentially issue fraudulent certificates that trusted systems might accept, allowing website impersonation or interception of encrypted communications under certain conditions.

eMudhra co-founder Kaushik Srinivasan told Reuters that a software error had unintentionally shortened the keys, weakening their cryptographic protection.

An independent cybersecurity researcher discovered the problem in October 2026, roughly 18 months after the affected keys were generated.

The discovery raised questions about the effectiveness of the company’s internal controls and independent security audits, neither of which identified the flaw during that period.

There has been no confirmed evidence that attackers exploited the weakness to impersonate websites or steal customer information.

Google, Apple and Microsoft subsequently moved to withdraw trust in eMudhra’s certificates, while Mozilla also took protective measures.

Removing trust can prevent browsers and operating systems from accepting certificates associated with an affected authority. However, websites and applications relying on those certificates may experience connection errors or security warnings until replacements are installed.

Older connected devices present a particular concern because their certificate trust stores are not always updated regularly. Some embedded systems could continue accepting credentials that updated browsers and operating systems no longer recognize.

eMudhra Chairman V. Srinivasan said the company revoked the affected certification authorities within 14 hours of identifying the problem.

He also said the eight intermediate certificates had not been used to issue certificates directly to individual websites or end users.

The company has committed to replacing affected customer certificates free of charge through its partners and maintaining certificate status and revocation services until existing certificates expire or are replaced.

The withdrawal applies to its global SSL/TLS certificate operations. Its India-regulated Digital Signature Certificate and eSign businesses will continue operating under the Controller of Certifying Authorities, which oversees a separate regulatory framework.

Government investigation and market fallout

India’s Ministry of Electronics and Information Technology has constituted a special team to investigate the incident, while the Indian Computer Emergency Response Team, CERT-In, has issued mitigation guidance concerning the affected certificates.

Investigators are expected to examine how the weak keys were generated, why the problem escaped detection during successive audits and whether any affected credentials were misused.

The failure to identify the weakness for 18 months has also drawn attention to the technical checks used by certificate authorities and the independent auditors responsible for assessing their compliance with international security standards.

The market reaction has been severe. eMudhra shares plunged nearly 38% over three trading sessions through Friday, 23 October, as investors reacted to the security lapse and the company’s decision to exit the global SSL/TLS certificate business. The selloff came despite the company’s assertion that global SSL/TLS certificate operations contribute only about 1% of its revenue.

Investors may be concerned about the wider reputational damage to a company whose business depends on customers trusting its security systems. eMudhra supplies digital identity, authentication and trust services to corporate and government clients, including major Indian technology companies.

The company has argued that the attention surrounding the incident is disproportionate to the financial contribution of the affected business.

Nevertheless, the withdrawal of trust by major browser and operating-system vendors has effectively undermined its ability to continue issuing publicly trusted certificates.

For eMudhra, the immediate challenge is to complete the transition without disrupting customers who depend on its certificates, while containing any damage to confidence in its remaining businesses, analysts said.