eMudhra Has Quit TLS. The Accountability Questions Haven’t

Added to Saved Stories in Login VIEW SAVED STORIES .inc42-toggle-item-popup { display: none; position: relative; } .toggle-item-close { text-align: end; padding: 8px 12px 0px 10px; position: absolute; right: 0; cursor: pointer; } .toggle-items-content-main { display: block; position: relative; top: 27px; left: -204px; border-radius: 12px; background: #FFF; box-shadow: 0px 4px 24px 0px rgba(100, 100, 100, 0.25); width: 435px; height: 115px; } .toggle-items-content { display: flex; align-items: baseline; justify-content: center; padding-top: 22px; } .toggle-items-content .items-content-text .h4-saved-story{ color: #000; font-size: 20px; font-style: normal; font-weight: 700; line-height: normal; text-transform: capitalize; margin: 2px 0 10px 6px; } .toggle-items-content .items-content-text .myInc42-plus-dark { width: 100px !important; } .toggle-items-content .items-content-text .myInc42-light { width: 80px !important; } .toggle-items-content .items-content-text img{ height: 22px; } .view-my-feed-btn { width: 100%; text-align: center; display: flex; justify-content: center; } .view-my-feed-btn a { width: auto !important; } .view-my-feed-btn button { border-radius: 4px; background: linear-gradient(180deg, #DA1B4D 0%, #E23026 100%); color: #fff; font-size: 12px; display: inline-block !important; min-width: 162px; width: 162px !important; height: 34px !important; font-style: normal; font-weight: 700; line-height: normal; padding: 10px; cursor: pointer; } .CustomIconStyled { position: absolute; right: 180px; top: -80px; } .SubDropdownModelShare .sub-arrow-icon { width: 76px; height: 80px; position: relative; overflow: hidden; box-shadow: none; } @media (max-width:767px) { .toggle-items-content .items-content-text .h4-saved-story{ margin: 4px 0 10px 6px; font-size: 18px; } .toggle-items-content { align-items: center; } }

On October 27, Google removed eMudhra’s root certificate called emSign ECC Root CA – G3. Any website still relying on it began showing Chrome users a full-page security warning.

This action follows a series of events that unfolded in mid-October with Bengaluru-based eMudhra, India’s largest licensed certifying authority, at the centre of it all. 

A researcher had shown that the private keys of eight certificate authorities under eMudhra’s global hierarchy were so weak that anyone could work them out. One of them was the number 4.

What followed was swift action, at least outside India. All major browser makers blocked the certificates within hours. Software maintainers shipped emergency patches and eMudhra revoked the certificates. 

Within five days of the vulnerability being reported, eMudhra’s board decided to exit the global TLS certificate business altogether.

However, in India, the response to this security incident has been noticeably slower. 

The IT ministry (MeitY) has formed a special team to investigate and CERT-In issued an advisory four days after the initial report of the vulnerability. 

While eMudhra has walked away from a business that it says contributes 1% of its revenue, the question is who holds a certificate authority accountable in India? What rules may have been broken by eMudhra in the process of this still-developing situation, and what could the penalties be? 

How The Browsers Shut The Door

The trouble began well before October. The eight keys were created at a single key ceremony, the formal process in which a certificate authority generates its keys, on April 30, 2025. Industry rules require such ceremonies to follow a written script, to be watched by a qualified auditor or recorded on video, and to be signed off in an auditor’s report.

eMudhra claims a flaw in its script created a second, weak set of keys, which were used by mistake because their labels looked similar. Each key should have been about 116 digits long; all eight were below 256. The flaw went undetected for about 18 months, across two audit cycles. “I don’t know. We went through two external audit cycles,” said........

© Inc42