# eMudhra to Exit Global SSL/TLS Operations Following Security Breach

*Published October 23, 2026*
*Source: [https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html](https://thehackernews.com/2026/10/emudhra-to-exit-global-ssltls-business.html)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/emudhra-to-exit-global-ssl-tls-operations-following-security-breach) or [see plans](https://www.sec-news.ai/pricing).*

## Article

eMudhra, an Indian certificate authority, has announced its decision to withdraw from the global SSL/TLS certificate business after a significant security issue was uncovered. The company's decision follows the discovery by a researcher that private keys for eight of its intermediate CA certificates were easily guessable. This revelation has led major browsers like Chrome and Firefox to stop trusting the eMudhra root certificates, impacting around 30,800 unexpired certificates. Most of these certificates were issued through InCommon, a service widely used in the higher education sector. eMudhra plans to replace affected customers' certificates with those from partner organizations, although specific partners and timelines have not been disclosed. In the meantime, eMudhra's G1 RSA root certificates will continue to support customers, but the future of these certificates in Chrome's root store remains uncertain. The company has stated that its exit from the SSL/TLS business is due to the complexity and cost associated with data sovereignty and compliance rules, as well as the disproportionate scrutiny the incident has drawn. Despite the issue, eMudhra assures that no breach of their systems occurred and that the affected keys were never used to issue certificates to websites or users. However, institutions like Cornell and the University of Michigan are advising their certificate holders to switch to RSA certificates or alternatives like Let's Encrypt. As eMudhra navigates through this transition, it will maintain its revocation and status services until all issued certificates have either expired or been replaced.