In a significant development for the digital security landscape, eMudhra (NSE:EMUDHRA) has announced its exit from the global SSL/TLS certification market following a critical signing-key failure. The Bengaluru-based company's October 22 announcement has left customers scrambling to replace their certificate chains before Google Chrome's scheduled trust removal on October 27. This move comes after the discovery of compromised intermediate certificates that could have allowed attackers to forge TLS certificates.
Scope of the Impact
According to the Chrome Root Program's public incident assessment, approximately 30,800 unexpired precertificates were issued under the affected root as of October 21. The vast majority—99.9%—were distributed through two InCommon authorities, with 23,806 organization validation (OV) certificates and 6,985 domain validation (DV) certificates. An additional 18 certificates came from other eMudhra issuers. These figures do not account for websites that have already completed replacements or those that have let certificates expire.
Automated Renewal Challenges
A key operational hurdle is the reliance on automated issuance. eMudhra estimates that 97% of certificates requiring migration were issued via ACME, an automated protocol. However, Chrome has warned that standard ACME clients may lack the necessary renewal-information support, potentially requiring manual intervention for certificates outside their normal renewal windows. Simply having automation in place does not guarantee readiness, as the transition may demand configuration changes and a switch to a different issuer.
Timeline of Events
The security incident unfolded rapidly. Google blocked the affected public keys at 19:45 UTC on October 17, and Mozilla completed Firefox's remote blocklist distribution at 22:59 UTC the same day, protecting users with standard configurations without requiring updates or restarts. eMudhra's decision to exit the TLS business was announced on October 22, with Chrome's root removal expected on October 27 (morning PDT). The company has not disclosed a timeline for completing customer transitions.
Impact on Customers and Industry Response
The eight compromised intermediates are a separate population from the broader root hierarchy. Google confirmed that six of these could issue TLS certificates, but none appeared in transparency logs before the block, limiting the exposure assessment to clients enforcing certificate transparency. eMudhra states that global SSL/TLS represents about 1% of its revenue, and it has seen no evidence of a breach or issuance of end-user certificates from the compromised authorities. The company has promised free replacements through partners, and revocation and certificate-status services will continue until all issued certificates expire or are replaced.
Industry experts have weighed in on the situation. Yash Kadakia, co-founder and CTO of Security Brigade, told CSO, "The last thing organisations need is to migrate twice." This sentiment underscores the uncertainty surrounding eMudhra's remaining authorities, which Google is currently investigating to determine whether they should retain trust status.
Mitigation Efforts and Remaining Risks
Some organizations have already taken action. Cornell University reported in an October 22 service update that most affected certificates had been reissued, and the immediate browser problem appeared mitigated. However, client-side repairs remain a separate challenge. Ubuntu's advisory, updated October 22, provides fixes for system certificate stores and the NSS security library, but also highlights a Java trust-store synchronization fault requiring additional manual action. A browser's remote blocklist cannot verify whether these independent stores have been repaired.
Risks persist for clients that retain an affected trust chain. They could still accept forged certificates during an intercepted connection, and removing trust before replacement could interrupt legitimate connections. Mozilla noted on October 23 that its questions from October 20 remained unanswered after an extended deadline, and Chrome's request for completed-migration totals also remains unresolved in the public record.
As the October 27 deadline approaches, the critical question remains: How many replacement chains will be installed in time? The incident highlights the fragility of the web's trust infrastructure and the importance of robust key management and rapid response protocols.