eMudhra Limited, an India-based certificate authority, said on Thursday it will withdraw from the global SSL/TLS certificate business, days after major browsers blocked eight intermediate TLS credentials that security researchers said were so weak that anyone could mint trusted certificates for any website or mail server.
The decision marks an abrupt retreat for a company that had been an accredited player in the global webPKI, the trust system that underpins HTTPS and secure email. It also illustrates how quickly a technical failure in the certificate authority ecosystem can become existential: browser distrust cuts off a CA from the market, and the reputational damage can outweigh the revenue the business generates.
A private key of 4
At the center of the incident are eight intermediate CA certificates. Intermediate CAs sit between a root certificate trusted by browsers and the end-entity certificates issued to websites. If an intermediate’s private key is weak or predictable, an attacker can use it to sign fraudulent certificates that browsers will accept.
Ars Technica reported that the intermediate TLS credentials were so weak that anyone could mint certificates for any website or mail server, and that one had a private encryption key of just 4. A key that small is trivially guessable; in practice, it is less a secret than a placeholder. The Hacker News headline summarized the same failure more bluntly: “eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable.”
The chronology matters. The Next Web reported that eMudhra dropped TLS certificates days after browsers blocked its keys. Browser makers maintain root programs that decide which CAs are trusted; when intermediate keys are compromised or weak, they can remove trust, effectively making certificates from that CA useless in Chrome, Firefox, Safari, and other clients. For a CA, that is the functional equivalent of a shutdown order.
Company cites costs, competition and 1% of revenue
In its announcement, eMudhra framed the exit as a business decision as much as a security response. V. Srinivasan, chairman of eMudhra Limited, cited increasing costs and complexities of compliance requirements, paired with the TLS business generating just 1 percent of revenue. He also said the emergence of organizations providing TLS certificates free of charge reduced returns on investment compared with other products and services.
The company also pushed back at the intensity of the scrutiny. “However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” eMudhra said in its Thursday post. “In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.”
That framing was echoed by business-oriented outlets. MSN carried headlines emphasizing that the segment contributes 1 percent of revenue and that the company would exit after a security incident. The message: global TLS was a small, costly, and now reputational risky line of business.
How outlets framed the story
Different outlets emphasized different lessons. Ars Technica led with the technical embarrassment—calling eMudhra “disgraced” and noting the absurdly weak key—and treated the company’s complaint about social media amplification as a defensive spin. Security-focused coverage, including The Hacker News, put the guessable intermediate CA keys at the center of the story, where they belong for anyone who understands PKI. The Next Web stressed the trigger: browsers had already blocked the keys, making the exit a response to market exclusion rather than a purely voluntary strategic pivot. MSN’s multiple headlines split between the security incident and the revenue rationale, reflecting a broader business audience that cares about materiality as much as cryptography.
The common thread is that eMudhra’s TLS business was small enough to abandon. If global SSL/TLS had been a larger revenue contributor, the company might have fought to repair trust, invest in stronger key management, and negotiate with browser root programs. At 1 percent of revenue, the calculus favored retreat.
Why the trust failure matters beyond one company
The webPKI is a supply-chain security system, and intermediate certificates are among its most sensitive links. A root key is kept offline and used rarely; intermediates are used to issue certificates at scale. Weak intermediate keys therefore undermine the entire chain. Even if a CA never issues a bad certificate intentionally, an attacker who can guess or derive an intermediate key can impersonate banks, email providers, governments, or any other site. That is why browser makers treat key compromise as a trust-store issue, not a customer-service issue.
The incident also underscores how commoditized TLS certificates have become. Free and low-cost CAs have compressed margins, while browser root programs have raised compliance, audit, and incident-response expectations. For smaller CAs, the cost of doing business globally can exceed the returns. eMudhra’s exit is a case study in that squeeze: a weak-key incident created scrutiny, but the underlying economics made withdrawal easier.
For customers, the practical implications are immediate. Any organization still using eMudhra-issued TLS certificates for public websites, APIs, or mail servers should assume those certificates may no longer be trusted by major browsers and should migrate to another CA. Enterprises should also review certificate inventories and automated renewal processes to catch dependencies on a CA that has left the global trust store.
For eMudhra, the retreat ends a global TLS business but not the company. It can concentrate on other products and services, where compliance costs and returns may be more favorable. The broader lesson for the certificate industry is less forgiving: in a system built on trust, a single weak private key can undo years of accreditation—and no amount of social media criticism is as decisive as a browser blocking your certificates.
