New Delhi: eMudhra's board has decided to voluntarily withdraw from the global SSL/TLS certificate business, and the government is exploring domestic alternatives to overseas audit firms in the international digital certificate ecosystem, The Hindu BusinessLine reported on Thursday, October 22.
Source: The Hindu BusinessLine — eMudhra issue: Government looking at domestic alternatives, Oct 22, 2026
The move follows the compromise of private keys linked to eight intermediate certificates operated by eMudhra, which could potentially have been used to issue fraudulent certificates and impersonate websites. The company said all eight certificates were revoked on October 19 and that none had been used to issue customer certificates, BusinessLine reported. Inc42 reported the company revoked the affected certificate authorities within 14 hours of discovering the incident and said its infrastructure was not compromised and no data was breached.
Source: Inc42 — eMudhra To Exit Certificate Business As Security Flaw Triggers Distrust, Oct 22, 2026
"It (BDO) is an international certifying agency/firm, is Belgium-based and it was not in our system. So, it took some time to handle the situation following the alerts. We are therefore now looking at alternative companies available here," a senior government official told BusinessLine, adding that alternative keys had also been created. The official said browsers were no longer accepting the affected keys and that most key government sites had been protected.
Source: The Hindu BusinessLine, Oct 22, 2026
Chairman V Srinivasan said global SSL/TLS contributed about one per cent of eMudhra's global revenue and that the decision reflected rising data-sovereignty and compliance requirements and costs, as well as free issuance by large entities reducing the business's return on investment, BusinessLine reported. Cofounder Kaushik Srinivasan told Inc42 the board felt it was prudent to withdraw given the risk to the rest of the business, and that existing customers would be transitioned to alternative providers free of charge over the next three to four weeks.
Source: Inc42, Oct 22, 2026
Inc42 reported the distrust of eMudhra's G3 ECC root by Google and Mozilla had affected around 30,000 certificates in the US, which were first transitioned to its G1 RSA root and would now move to another provider; certificates in India were issued from the G1 root. MeitY has set up a special investigation team headed by the Deputy Controller of the Controller of Certifying Authorities, with officials from CERT-In, Aadhaar and NPCI, and the company said its regulated Digital Signature Certificate and eSign services remain unaffected.