Indian digital trust company eMudhra has exited the global SSL/TLS certificate market after private keys were compromised for eight of its intermediate certificate authorities, the company announced. The board decided to voluntarily withdraw from the global SSL/TLS certificate business, citing increasing data sovereignty and compliance requirements that heightened business complexity and cost. The company will offer replacement certificates from Sectigo to affected customers at no charge and will maintain revocation and certificate status services until all issued certificates expire or are replaced.
Key Compromise and Corporate Response
The compromise of eight intermediate certificate authorities triggered eMudhra’s decision to leave the global TLS certificate business. In a press note, eMudhra stated that the level of social media amplification around the incident had drawn scrutiny disproportionate to SSL/TLS’s role in its operations. eMudhra Chairman V Srinivasan emphasized that the board’s decision reflects the need to address trust and governance concerns stemming from the security breach.
eMudhra will contact affected customers directly to provide free replacement certificates through its partners. The company’s G1 root certificates remain active and fully supported, with the G1 RSA roots continuing to serve customers until the transition is complete.
Industry Reactions and Recommendations
Principal analyst Niyati Daftary at Gartner advised organizations to treat eMudhra’s G1 roots as a temporary bridge rather than a long-term solution. She recommended establishing firm deadlines and documenting migration plans to shift critical services to independent, fully trusted certificate authorities where feasible.
Security expert Yash Kadakia expressed concerns that migrating to another root operated by the same company may not fully address trust and governance issues. “The last thing organisations need is to migrate twice,” Kadakia said.
Technical Challenges and Mitigation Strategies
Replacing a website’s certificate may not resolve all enterprise dependencies, according to Sakshi Grover, research director at IDC. Systems maintaining independent trust stores, such as Java keystores, language runtimes, container images, mutual TLS configurations, proxies, load balancers, VPNs, and security appliances, may require separate remediation efforts. Grover noted that many organizations struggle to identify where certificate trust decisions occur outside browsers and operating systems, particularly in environments that do not update on the same schedule.
Grover noted that Google reported finding no certificates chaining to the affected intermediates in Certificate Transparency logs before they were blocked. She said this was reassuring for clients that enforce Certificate Transparency, but some non-browser applications and devices lack this safeguard, leaving residual risk limited and targeted rather than broad. Attacker exploitation would still require traffic interception capabilities.
Java vendor Azul confirmed that Java does not check certificate revocation by default. An unpatched JDK could accept a forged certificate signed with a compromised intermediate key if the certificate chain remains trusted. Azul released updated Azul Zulu Builds of OpenJDK and Azul Prime, adding the eight affected certificates to the JDK’s blocked-certificate list.
Browser Trust and Migration Deadlines
Mozilla removed emSign ECC Root CA – G3, the root certificate that signed the eight compromised intermediates, from its trust store. Google announced that the root’s removal from the Chrome Root Store would reach all devices by October 27, Pacific time. To prevent service disruptions, Google advised website operators with certificates chaining to emSign ECC Root CA – G3 to immediately obtain and install new TLS certificates.
Daftary observed that enterprises often know their certificate reseller but lack visibility into the underlying CA hierarchy, creating an unrecognized fourth-party risk capable of affecting thousands of services simultaneously. She emphasized that CISOs should incorporate issuing CAs, roots, cross-signing arrangements, and revocation infrastructure into their third-party risk assessments. Kadakia reinforced that outsourcing a service does not eliminate accountability, stating, “You can outsource a service, but you cannot outsource accountability.”
