eMudhra stops issuing SSL/TLS certificates after researchers reconstruct private keys in under a second

Situation Overview

On 22 October 2026, Indian certificate authority eMudhra said it will stop issuing SSL/TLS certificates, closing an incident in which major browsers blocked its certificates and Indian authorities launched an investigation. The company said researchers demonstrated that the private keys securing eight of its certificates were weak enough to be reconstructed in under a second, undermining the trust model for the affected certificates. The next concrete step signalled by eMudhra is its exit from the global SSL/TLS certificate business, following the board decision referenced in its statement.

Geopolitical Implications

1. 01

   The incident shows how trust infrastructure (PKI) failures can trigger rapid cross-border browser actions against a national CA.

2. 02

   A government investigation and CA exit can accelerate migration to alternative trust providers and stricter key-management controls.

Key Signals

• —

  Updates from Indian authorities on the investigation into the certificate and key-management failures.

• —

  Details on how eMudhra will handle affected certificates and any revocation or migration steps.

Topics & Keywords

Market Impact Analysis

AI Threat Assessment

Event Timeline