eMudhra, an Indian certificate authority, has announced that it will exit its global SSL/TLS certificate business after a researcher reported recovering the private keys of eight of its intermediate CA certificates. For businesses, the development is significant because trust in certificate authorities underpins HTTPS websites, secure APIs, SaaS platforms and many machine-to-machine connections.

What happened

According to the reported disclosure, a researcher was able to recover the private keys for eight eMudhra intermediate CA certificates. Intermediate CA keys are highly sensitive because they are used to issue end-entity certificates for websites and other digital services. If such keys are compromised or predictable, they can undermine confidence in certificates issued through that part of the trust chain.

eMudhra said its board decided to withdraw from the global SSL/TLS certificate business. The company also said it would replace affected customers' certificates free of charge through partner providers. Based on the available information, this is a company-announced remediation step rather than an independently verified resolution of every operational impact.

Why it matters for European businesses

SSL/TLS certificates are a basic part of digital operations. They secure website traffic, customer logins, checkout pages, APIs, admin portals and many cloud-connected services. When a certificate authority experiences a serious trust or key management issue, businesses may need to replace certificates quickly to avoid browser warnings, service disruption, compliance concerns or loss of customer trust.

For European companies, the main issue is not only whether they bought certificates directly from eMudhra. Many organisations use hosting providers, resellers, managed security providers or enterprise PKI partners, so the affected certificate chain may exist somewhere in their infrastructure without being obvious to procurement or marketing teams.

The incident also highlights a broader supply-chain risk in digital trust services. Certificate authorities sit deep in the internet security stack. Problems at that level can affect websites, mobile apps, customer portals, VPNs, email security and automated integrations across multiple business units.

Who may be affected

• Companies using eMudhra-issued SSL/TLS certificates for public websites, subdomains, APIs or business applications.
• E-commerce businesses that depend on uninterrupted HTTPS availability for checkout, payments and customer account access.
• IT and security teams managing certificate inventories across web servers, load balancers, CDNs, cloud environments and internal services.
• Digital agencies and managed service providers responsible for client hosting, website maintenance or certificate renewals.
• Regulated businesses that need clear documentation of incident response, vendor risk handling and service continuity.

What companies should consider

• Identify exposure
  Check whether any public-facing or internal certificates in your environment were issued by eMudhra or depend on affected intermediate certificates. Include websites, APIs, mail systems, VPNs and third-party hosted services.
• Coordinate replacement early
  If you are an affected customer, review eMudhra's replacement process and timelines. Confirm whether replacement certificates will be issued by a partner CA and what operational steps are required on your side.
• Review certificate inventory and ownership
  Many businesses lack a complete view of where certificates are installed and who is responsible for renewals. This incident is a reminder to maintain an up-to-date inventory across teams and suppliers.
• Test deployment and rollback procedures
  Replacing certificates can affect load balancers, CDN configurations, mobile apps, older clients and automated integrations. Validate changes in staging where possible and prepare rollback plans for critical services.
• Assess vendor concentration risk
  Businesses that rely heavily on one CA or one hosting supplier may want to review contingency options and certificate lifecycle management processes.
• Document the security and compliance response
  For regulated organisations, keep records of exposure checks, replacement decisions, change windows and customer-impact assessments.

At this stage, the key practical question for businesses is whether any production services depend on the affected certificate chain and how quickly those certificates can be replaced without disrupting operations. Even organisations with no direct relationship with eMudhra may want to verify their certificate supply chain through hosting, cloud or managed service providers.