eMudhra Exits TLS Market After Issuing Eight Defective Intermediates With Keys From 4 to 237

eMudhra announced its exit from the global TLS business on 17 October 2026. Chairman V. Srinivasan cited rising compliance costs and the unit contributing only one percent of revenue. The board acted two days after public disclosure of the defective certificates. The company stated social-media scrutiny exceeded the business segment’s scale and chose to redirect resources to other product lines.

The eight intermediates used NIST P-384 curves yet contained private keys of 4, 56, 66, 115, 155, 156, 230 and 237. Correct P-384 keys require roughly 2^384 distinct values. The strongest defective key permitted at most 256 candidates, recoverable in milliseconds. Any party obtaining these keys could issue browser-trusted certificates for arbitrary domains, mail servers and container images that embed the eMudhra root.

The incident reveals systemic gaps in private-key generation and validation inside at least one WebTrust-audited CA. Similar entropy failures have appeared in other CAs over the preceding decade, yet automated tooling to detect sub-256-bit keys remains absent from most root-program audits. Operational impact includes immediate requirement for all relying parties to audit eMudhra intermediates in their trust stores and accelerate migration to alternate CAs.

Root programs must now decide whether to retain eMudhra roots during the wind-down period. Browser vendors typically set 90-day distrust timelines once key-compromise evidence is confirmed. Enterprises holding cached eMudhra intermediates face parallel revocation obligations to prevent continued issuance of forged certificates.