eMudhra said on October 22, 2026, that its board has decided to leave the global SSL/TLS certificate business. The company promises free replacement certificates through partners for affected customers, but gives no final exit date. Website operators now face a supplier transition alongside the security response to compromised certificate-authority keys.
Mozilla says eight eMudhra intermediate certificates had compromised private keys. It received the report on October 17. Those keys could let an attacker issue fraudulent HTTPS certificates for websites they do not control. An attacker able to intercept a connection could then impersonate the website and potentially read or alter traffic.
What customers are promised
Affected customers will receive replacement certificates from partners free of charge, eMudhra says. Its transition notice also says its G1 RSA roots will continue serving customers while it works with browser programs and customers on the move. That is the company's commitment; the announcement does not establish how every browser or application will treat an individual certificate throughout the transition.
Revocation and certificate-status services are part of that commitment. eMudhra says those services will run until every issued certificate has expired or been replaced. The notice does not name the replacement partners or provide a dated migration schedule. Administrators have specific details to request from their supplier: which replacement chain they will receive and when they must deploy it.
The withdrawal covers global SSL/TLS certificates. eMudhra says its digital-signature, eSign and other signing services run on separate infrastructure and remain unaffected. It puts the departing business at about 1% of global revenue and cites rising compliance costs and competition from free certificates among its reasons for leaving. Those are the company's explanations for its board's decision.
Why the security work continues
eMudhra says no end-entity certificates were issued from the affected certificate authorities, and that its infrastructure was not compromised and no data was breached. That assurance addresses its own issuance and systems. Mozilla's warning concerns what someone holding the compromised keys could forge. The absence of legitimate customer certificates from those authorities does not remove that risk, as the browser maker's explanation makes clear.
Mozilla blocked the affected certificates through OneCRL, its revocation list. It also announced an NSS trust-store update to protect applications that use Mozilla's certificate lists without receiving OneCRL updates. That difference in distribution matters to developers: a browser's protection does not establish that another application's certificate checks have changed. We have not tested individual clients for this article.
The next useful milestones are a customer migration schedule and the full root-cause report eMudhra has committed to deliver to browser root programs. Neither the replacement partners nor the final withdrawal date is specified in the exit announcement. Customers need those details to turn the promised transition into a deployment plan.