Certificate authority eMudhra is getting out of the TLS business.
Ars Technica reports that the company — one of the more established names in the Indian PKI industry and a root trusted in browser and operating system stores for years — is winding down its certificate operations after a private-key mishandling came to light. According to the report, eMudhra used a private key tied to certificates it had issued. That sits at the very bottom of the CA/Browser Forum's baseline requirements: every certificate is supposed to be issued with a freshly generated key pair that the CA neither reuses nor retains.
The consequences reach past a single bad issuance. Certificate authorities hold their standing through audit and through the trust programs run by Google, Mozilla and Apple, and a CA found cutting corners on key handling can be put on a path toward distrust — which in practice means the certificates it issues stop being accepted. For eMudhra the cheaper route appears to have been leaving the TLS market entirely rather than working through remediation and re-audit.
For website operators the practical step is the usual one: work out which certificates in your estate were issued by eMudhra and plan replacements before the current ones expire. For the wider PKI ecosystem the episode is another reminder of how concentrated and how fragile the web's trust layer remains, and how quickly a single control failure can end a business that took decades to build.
