eMudhra exits global SSL/TLS business after compromised CA keys

Trust in digital certificate infrastructure is faltering once again. eMudhra, an Indian certificate authority (CA), has decided to withdraw from its global SSL/TLS certificate business. The decision was made by its board of directors on Thursday, just five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. The company has announced that it will replace affected customer certificates with free ones from partners, although details on scope and timelines have not yet been made public.

The incident highlights a risk that often goes unnoticed by SMBs: the chain of trust on which their encrypted communications rely. When an intermediate CA has its private key compromised, an attacker could issue fraudulent certificates that browsers would accept as valid. In this case, the researcher managed to recover those keys, which in practice makes it possible to impersonate the identity of websites and services that trust eMudhra.

What it means for your company

If your organization uses certificates issued by eMudhra — whether for the corporate website, a customer portal, or internal communications — you will likely receive a replacement notice in the coming days or weeks. The withdrawal from the global business means that eMudhra will stop issuing and renewing these certificates, so continuity will depend on the replacement certificates it offers through its partners.

Beyond this specific case, the episode underscores the importance of not relying on a single trust provider. SMBs often purchase SSL/TLS certificates through resellers or their hosting provider, and rarely check which root CA is behind them. A failure like this can leave services inaccessible or, worse still, exposed to impersonation if action is not taken quickly.

The news also serves as a reminder that the security of the certificate supply chain is a critical link. It is not just about renewing on time, but about knowing who issues, how they protect their keys, and what contingency plans they have. In this sense, eMudhra's decision to abandon the global business is a drastic measure but consistent with the severity of the finding: eight recoverable intermediate keys are a breach that is difficult to justify to browsers and customers.

Recommendations for IT teams

In a situation like this, the first step is to identify whether your organization has certificates issued by eMudhra. Check the issuer in the chain of each deployed certificate, both on web servers and in email, VPN, or API services. If you find any, contact your provider to learn about the replacement plan and request a replacement certificate from a recognized trusted CA.

In addition, it is advisable to establish an up-to-date inventory of certificates and their expiration dates, with automatic alerts. This is not the first time an incident of this type has forced urgent certificate rotation; having a documented process saves time and prevents interruptions. For SMBs with limited resources, one option is to delegate management to a trusted partner that monitors the certificate chain and provides notice of changes in CAs.

Finally, review your vendor policy: do you know which CA your hosting provider or payment gateway uses? Including this information in security questionnaires and demanding transparency about the chain of trust is a simple measure that makes a difference. eMudhra's withdrawal is a warning: trust in certificates is not eternal and must be actively managed.

At ForgeNEX we closely follow this type of incident because it directly affects the operations of SMBs. If you need help auditing your certificates or designing a continuity plan, do not hesitate to contact us.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.