eMudhra quits the global TLS certificate business after its weak CA keys were revoked
The company says SSL/TLS is about 1% of its revenue and that social media amplification of the incident was out of proportion. Browser vendors had already pulled the affected intermediate CAs.
eMudhra will withdraw from issuing public TLS certificates, keeping revocation services running until every issued certificate has expired or been replaced. Customers get replacements free through partners.
In the thread, a commenter reports that an up-to-date iPhone was still trusting the compromised CAs nearly five days after the report.
What the exit announcement actually promises
In a press release dated 22 October 2026, eMudhra's board says it will voluntarily leave the global SSL/TLS certificate business. Its Indian digital signature and eSign services, enterprise PKI, emSigner and SecurePass are untouched. The stated reasons: data sovereignty rules raising cost and complexity, free certificates from big issuers cutting returns, and a business worth roughly 1% of global revenue.
The release says the affected CAs were revoked within 14 hours of discovery, that no end-entity certificates were issued from them, and that no infrastructure was compromised. Chairman V. Srinivasan calls the social media amplification "out of proportion". No completion date is given. The G1 RSA roots keep serving customers until the transition ends, and a full root-cause report is still owed to the browser programs.
How two key sets got mixed up
The incident behind the exit is tracked as CVE-2026-111943, a compromised intermediate certificate authority. The thread's best account of the cause comes from Mozilla's tracker.
"According to eMudhra, proper strong keys were created in the HSM at the key ceremony on 30-04-2025. The script had been changed to test wrapping and unwrapping keys … and a bug in that change created a second set of weak keys. The keys had almost identical names, and the weak ones were used for the certificate requests." — a commenter relaying eMudhra's report on Mozilla's tracker
Commenters' shorthand for non-technical friends was that the secret turned out to be the number 4, a framing the report above does not confirm. Explaining it turned into a game of its own. A document-automation developer in Prague admitted he could not find a metaphor as ridiculous as the real event:
"Maybe, like, setting up a factory that builds both LHD and RHD cars and building cars with two passenger seats in the front for two years straight without anyone noticing?" — a document-automation developer in Prague
Chrome took 1h40, Apple was still trusting them days later
The sharpest practical claim in the thread is about speed of response.
"Google Chrome revoked these certificates in 1 hour 40 minutes, Mozilla in just under 4 hours." — a commenter testing an iPhone 15 Pro against the trust store
The same commenter reports that the phone, on trust store version 2026073000, was still accepting certificates from three eMudhra intermediates nearly five days after a researcher told Apple. That is one person's test, not Apple's statement. It does show why a root program that cannot revoke fast matters more than the fate of one small CA.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Quad9 will leave France rather than block piracy domains for a Qatari broadcaster
A French court ordered the DNS resolver to block domains for French users on behalf of beIN, and cut the daily penalty from €580,000 to €1,000. Quad9's answer is to stop serving the country on November 24.