eMudhra Voluntarily Withdraws from Global SSL/TLS Business Following CA Revocation Incident

eMudhra Limited has announced its voluntary exit from the global SSL/TLS certificate business following a security incident that required the revocation of affected CAs within 14 hours. The company confirmed that its Web PKI infrastructure was logically segregated, leaving its core enterprise PKI, digital signature, and identity management platforms unaffected.

Strategic Exit and Web PKI Market Dynamics

eMudhra Limited (BSE: 543533 | NSE: EMUDHRA) announced on October 22, 2026, that its Board of Directors has voted to voluntarily withdraw from the global SSL/TLS public certificate authority market. The decision marks an operational shift to reallocate engineering resources toward enterprise PKI, identity governance, and localized digital trust services.

According to leadership, global SSL/TLS issuance represented approximately 1% of eMudhra’s cumulative revenue. Management cited the compounding complexity of international data sovereignty compliance alongside declining margins in the public Web PKI sector—driven primarily by non-profit and large enterprise providers offering zero-cost automated certificates—as key drivers for the strategic exit.

Incident Timeline and Containment Audit

The withdrawal follows a recent security incident affecting eMudhra’s global SSL/TLS intermediate infrastructure. Chairman V. Srinivasan stated that the organization contained the issue by revoking the affected subordinate Certificate Authorities (CAs) within 14 hours of initial discovery and submitting disclosures to root store maintainers.

Internal telemetry and security audits revealed the following parameters regarding the event:

• Zero end-entity certificates were issued out of the affected CAs prior to revocation.
• Physical and logical access controls maintained integrity throughout the incident lifecycle.
• No internal data breaches or base infrastructure compromises occurred.

Despite containment, eMudhra noted that social media coverage and subsequent scrutiny surrounding public Web PKI operations generated reputational friction disproportionate to the segment's financial contribution. The company is completing a root-cause analysis report to satisfy remaining obligations to major browser root programs.

Sunsetting Lifecycle and Infrastructure Isolation

To prevent operational disruption for existing reliance parties, eMudhra’s G1 RSA root certificates will remain active while the customer base transitions to replacement issuance paths. The organization will maintain certificate revocation lists (CRLs) and Online Certificate Status Protocol (OCSP) endpoints until all currently issued end-entity certificates either reach natural expiration or undergo active migration. Affected customers are being provided free replacement certificates through third-party partners.

eMudhra emphasized that its public SSL/TLS issuing architecture operated on dedicated, isolated infrastructure. As a result, the enterprise trust pipeline remains fully operational without architectural modification. Unaffected product lines include:

• Enterprise PKI management platforms (emCA, CertiNext)
• Indian and global Digital Signature Certificate (DSC) and eSign infrastructure
• Document signing automation engines (emSigner)
• Identity and access management platforms (SecurePass, emAS)