eMudhra Exits Global SSL/TLS Certificate Market After CA Key Compromise

What happened

Indian digital trust company eMudhra is withdrawing from the global SSL/TLS certificate business after the private keys behind eight of its intermediate certificate authorities (CAs) were compromised. The company's board decided "to voluntarily withdraw" from the market, citing data sovereignty and compliance requirements that had increased the complexity and cost of the business.

Customers are being offered certificates issued by Sectigo as a replacement route. eMudhra says it will contact affected customers to replace their certificates free of charge. It has also committed to keep its revocation and certificate status services running until every certificate it has issued has either expired or been replaced, so that existing customers can still verify certificate status during the transition.

Chairman V Srinivasan said the level of social media attention around the incident had brought scrutiny that was out of proportion to the place SSL/TLS holds in the company's wider business.

Why it matters

Digital certificates are one of the least visible parts of a customer's digital experience, and they are noticed mainly when something goes wrong. A compromise at the certificate authority level turns an invisible dependency into a forced migration, with the experience of that migration largely determining whether customers continue to trust the services affected. Replacement at scale, clear communication about timelines and continuity of status checks all shape that experience far more than the headline decision to exit.

For leaders in digital transformation, the case highlights how much modern service delivery rests on trust infrastructure supplied by third parties. Organisations that have treated certificate management as a set-and-forget task may find that a provider's strategic exit, or a compromise, requires rapid action across many systems. The episode also underlines why data sovereignty and compliance demands are reshaping the economics of specialist digital trust providers.

Key facts for readers

• eMudhra's board has decided to exit the global SSL/TLS certificate business.
• The decision follows the compromise of private keys behind eight intermediate certificate authorities.
• Sectigo-issued certificates are offered as the alternative for affected customers.
• Revocation and certificate status services will remain active until all issued certificates have expired or been replaced.

The Renascence take

Most coverage will focus on the withdrawal itself, but the real test for customers is the replacement process and the trust signals that surround it. An operator's credibility during a certificate failure depends less on the cause of the failure than on how easily customers can see what has changed, what they must do and whether their services still work while they do it.

The headline is about an exit, but the customer experience is defined by the handover. Customers judge trust by how a provider handles failure, not by the failure itself, and a free replacement offer means little if the migration path is unclear. Any organisation that relies on third-party certificates should map every dependency now, identify which services would break first and rehearse the replacement before it is needed. Treat certificate management as a customer-facing service, not an IT housekeeping task.