eMudhra exits the global TLS certificate business; Indian DSC and eSign continue
After the weak-key incident, eMudhra says it will leave the global SSL/TLS market. Its Indian Digital Signature Certificates, eSign and document-signing products continue.
On 22 October 2026 eMudhra's board announced a voluntary exit from the global SSL/TLS certificate business, five days after eight of its intermediate CA keys were found to be weak and blocked by browsers. India's Ministry of Electronics and IT has set up a team to investigate, and CERT-In issued an advisory (CIAD-2026-0050).
What continues
- Indian Digital Signature Certificates (DSC) and eSign, which are regulated by the Controller of Certifying Authorities, are reported as unaffected and continue.
- eMudhra's enterprise PKI, document signing (emSigner) and identity products continue.
- Existing TLS certificates on its RSA hierarchy keep working until they are replaced during the wind-down; revocation services stay online until every certificate has expired.
What it means for website owners
If your website uses an eMudhra TLS certificate, plan to move to another CA at your next renewal - or sooner if it chains to emSign ECC Root CA - G3, which Chrome removes from 27 October 2026. When you switch, check that your new certificate's CA is listed in your DNS CAA records, otherwise issuance is blocked; the DNS check on your certificate page shows the exact record to add.
Document signing users in India with eMudhra DSC tokens do not need to change anything because of this incident.
Source: cybersecuritynews.com ↗