When you open a website, the small lock icon in your browser’s address bar is an SSL certificate. It proves the site is who it says it is. Bengaluru’s eMudhra, which issued such certificates to companies and government agencies, is now exiting that global business — after Google, Apple and Microsoft stopped trusting its certificates over a key flaw.
Updated: October 23, 2026, 10:30 IST
Quick Read
- eMudhra revoked 8 intermediate certificates on October 19, after researchers found weak keys that could be cracked in under a second.
- Google, Apple and Microsoft have withdrawn trust in the company’s certificates.
- Shares fell 40% in two days; MeitY has formed a special investigation team.
Bengaluru-based eMudhra has shut down its global SSL/TLS website-certificate business, Hindustan Times reported on October 23. The exit follows the discovery of a serious key-generation flaw that led the world’s biggest browser and device makers to distrust the company’s certificates. The firm’s shares crashed 40% in two days, and the IT ministry has ordered a special probe.
What the flaw was
Independent researchers found 8 cryptographic keys issued by eMudhra that were dangerously weak. The keys used simple, guessable numbers — 4, 56, 66, 115, 155, 156, 230 and 237. Each could be recovered in under a second, Financial Express reported. The weak keys came from a key-generation ceremony held in April 2025. eMudhra revoked all 8 intermediate certificates on October 19.
For readers new to the term: a certificate authority creates the digital “ID cards” that let your browser trust a website. If those ID cards are weak, anyone could fake them — which is why browsers reacted so fast.
Google, Apple and Microsoft pull trust
The three companies that decide which certificates browsers and phones trust — Google, Apple and Microsoft — withdrew trust in eMudhra’s certificates. Chrome, which runs on most of India’s phones and computers, no longer treats them as safe. The company called the scrutiny “disproportionate”, according to Hindustan Times.
Also read
40% crash and a government probe
The market punished the company fast. eMudhra’s shares fell 40% in two trading days. The Ministry of Electronics and IT (MeitY) has formed a special investigation team with members from the CCA, CERT-In, Aadhaar and NPCI, The Daily Jagran reported. This is serious because eMudhra’s certificates protected some of India’s most-used sites.
Customers and the India question
eMudhra’s customers include Infosys, TCS and government agencies. Its certificates once protected India’s income-tax portal. The company says the exited global business made up only about 1% of its revenue, and its regulated digital-signature and eSign services are unaffected. Meanwhile, India is looking at domestic alternatives for certificates — so a failure like this cannot leave Indian websites exposed again.
Practical note for website owners: if your site uses an eMudhra SSL certificate, ask your hosting provider this week about switching to another provider. Visitors may soon see security warnings on eMudhra-issued certificates.
Also read
FAQ
What does an SSL certificate do?
It is the lock icon in your browser. It encrypts data between you and the website and proves the site is genuine. Without a trusted certificate, browsers show a “not secure” warning.
Will Indian websites stop working?
Not immediately. Browsers phase out distrusted certificates over weeks. But site owners should switch providers now, before visitors start seeing warnings.
Is eMudhra’s eSign business affected?
No. The company says its regulated digital-signature and eSign services are separate and unaffected. Only the global website-certificate business is exiting.
