eMudhra Puts Its Global TLS Business at About 1% of Revenue After a Weak-Key Flaw

On 21 October, eMudhra, an Indian company, filed a statement with the BSE stock exchange about a flaw in the key process it ran on 30 April 2025. The company says the flaw produced a second set of weak keys alongside the strong ones, and eight of its intermediate certificate authority certificates were affected.

Six of the eight are TLS intermediates, which sign the certificates that secure websites. The other two are for code signing. Browsers blocked the affected intermediates within hours of a report on 17 October. For a company whose global TLS business is about 1% of revenue, the filing sets out that share, what the company is doing for customers and its account of the incident.

A certificate authority signs the certificates that websites present to browsers. When a browser stops trusting an authority’s root, every site certificate that chains to that root is affected.

What the Filing Says About the TLS Business

According to the filing as reported by The Hacker News, eMudhra’s global TLS business accounts for about 1% of company revenue. The company also acknowledged a reputational risk that it cannot quantify.

The six TLS intermediates chain to emSign ECC Root CA – G3, a root that browsers trust directly. Each TLS intermediate also has a Sectigo cross-signed copy. Chrome’s block matches the public key, so it also covers those copies, according to The Hacker News.

The filing says the company’s roots and issuing CAs passed independent audits two years in a row and have been in browser trust lists since mid-2025. It says its infrastructure was not compromised and no data was breached. The company says its Indian digital signature certificate and eSign businesses run on separate infrastructure and are not connected to the incident.

A statement the company posted on its website on 20 October adds that its root CA private keys and other intermediates are not affected. It also says only one of the eight intermediates was deployed in production, and that none of the eight, including that one, had issued an end-entity certificate.

Chrome Removal Date
Google expects the removal of emSign ECC Root CA – G3 to reach Chrome devices on Tuesday, 27 October 2026, Pacific time. Website operators with certificates under that root must move to another hierarchy before then.

Replacement Certificates and the Share Price

eMudhra says it is giving affected customers replacement certificates and is working with the root programs on root-cause analysis.

Google’s guidance to website operators is direct. Any operator with a certificate chaining to emSign ECC Root CA – G3 must immediately get and install a new TLS certificate from another hierarchy in the Chrome Root Store, or the site may break once the removal takes effect. eMudhra has committed to helping affected subscribers migrate.

Business Standard reported that the company’s shares fell 20% in Mumbai on 21 October, the day of the filing. The Hacker News cites that figure. The company says it cannot quantify the reputational risk it describes.

The Timeline From Report to Removal

Google says the researcher’s report reached the Chrome Root Program at 18:05 UTC on Saturday, 17 October. Chrome shipped a CRLSet update blocking the affected intermediates at 19:45 UTC the same day, and the block took effect without a browser update or restart. Mozilla received the report at 20:06 UTC and completed its OneCRL block for standard Firefox installs at 22:59 UTC.

Those two mechanisms explain the speed. OneCRL was introduced in 2015 for Firefox 37, and Mozilla said then that it covered only CA intermediate certificates, not roots. Mozilla’s post says it delivers fresh revocation data without an update or restart. The Chromium Project describes CRLSets as the primary means by which Chrome quickly blocks certificates in emergency situations, and says Chrome generally does not run online OCSP or CRL checks, though enterprises can enable online OCSP checks by policy.

Google says Android devices received an equivalent block through Google Play Services around 22:00 UTC on 19 October. Per The Hacker News, Apple blocked the certificates on 19 October and Microsoft followed on 20 October. On 20 October, Mozilla and the Chrome Root Program confirmed the compromise.

Mozilla’s post says NSS 3.131.1 removes the root that signed the affected intermediates, which protects applications that use Mozilla’s trust store and do not receive OneCRL updates. Google expects the removal of emSign ECC Root CA – G3 to reach Chrome devices on Tuesday, 27 October, Pacific time. Prerelease channels such as Chrome Canary and Beta will receive it sooner.

Chrome’s Review of eMudhra’s Other Certificates

Google says its Chrome Root Program is investigating whether eMudhra’s remaining CA certificates stay in the Chrome Root Store. It will share further updates in public forums, such as the Common CA Database Public list. That review covers more than the single root being removed on 27 October.

Google also says no TLS certificates chaining to the affected intermediates were logged to Certificate Transparency before the block. It says it reviewed the other keys in its root stores and found no other keys with the same weak-entropy problem.

The Hacker News reports that Mozilla does not believe, for now, that other CAs are affected. Mozilla is working on the root cause, and eMudhra says its own root-cause investigation is ongoing.

eMudhra’s global TLS business accounts for about 1% of company revenue.

Symantec’s 2017–2018 Distrust as a Precedent

The closest precedent in the coverage is Symantec. According to CSO Online, the sale of Symantec’s CA business to DigiCert was announced as completed on 31 October 2017, and from 1 December 2017 all new Symantec and sub-brand certificates had to be issued from DigiCert roots. Chrome’s distrust of Symantec-issued certificates was set to reach most web users on 17 April 2018, with a further stage in Chrome 70 ending with its stable release in October 2018.

Chrome’s first step had a separate date. Certificates issued before 1 June 2016 were distrusted in Chrome 66 beta from 15 March 2018. That date created a certificate renewal event for site owners. DigiCert told customers it had sent about 700,000 emails and offered free replacement certificates for the current validity period. Its CEO said demand was far larger than expected and strained its systems, which were later upgraded. CSO Online reports that the large majority of customers took advantage of DigiCert’s help with the 15 March 2018 date.

eMudhra’s filing gives a revenue share for its TLS business.

Open Questions for the Business

It has not been reported whether anyone used the weak keys before they were blocked. The root-cause work at Mozilla and eMudhra is still under way.

The remaining decisions sit with the root programs. Google has not said whether eMudhra’s other CA certificates will stay in the Chrome Root Store. eMudhra has committed to working with affected subscribers to migrate them off the root.