Indian CA eMudra Pulls Global SSL/TLS Offerings After Vulnerability Exposes Intermediate Keys

eMudra Ltd., a prominent Indian certificate authority, announced on Thursday that it will discontinue its worldwide SSL/TLS certificate services following a security incident that revealed eight of its intermediate CA private keys could be derived with relative ease.

The board’s decision comes just five days after an independent security researcher disclosed that the compromised keys allowed the reconstruction of the certificates’ signing chain, raising concerns about the integrity of any websites protected by those certificates. While eMudra has not disclosed the total number of customers affected, the vulnerability could potentially undermine the trust model that underpins encrypted web traffic.

Intermediate certificate authorities sit between a root authority and end‑entity certificates, handling the bulk of daily signing operations. When an intermediate key is weak or predictable, attackers can forge certificates that appear legitimate to browsers and other clients, enabling man‑in‑the‑middle attacks or the impersonation of trusted sites. The researcher’s findings suggested that the eight keys followed a pattern that could be reproduced without extensive computational effort, a scenario that security experts deem unacceptable for a public‑facing PKI.

Industry analysts note that the episode highlights ongoing challenges in the global certificate market, where dozens of CAs compete for enterprise and consumer trust. The breach may prompt larger providers to reevaluate their key‑generation practices and reinforce audit mechanisms. For eMudra, the withdrawal from the global market could be a strategic retreat to focus on domestic services, where regulatory oversight and customer relationships are more established.

Regulators in India and abroad are expected to examine the incident closely, and eMudra has pledged to cooperate with any investigations. The company also indicated that it will work with affected clients to replace compromised certificates and mitigate potential exposure. The broader takeaway for organizations is a reminder to monitor the provenance of their digital certificates and maintain a robust incident‑response plan for PKI‑related threats.