When customers visit a banking website, sign a digital contract, or submit information through a government portal, they rarely think about the cryptographic systems working behind the scenes. They expect the website to be genuine, their information to remain protected, and the service to function without interruption. Digital certificates help make that confidence possible. When a weakness emerges in the organisation responsible for issuing those certificates, the consequences can extend well beyond a single company.
The recent security incident involving eMudhra, an Indian provider of digital identity and trust services, illustrates why certificate security deserves attention at boardroom level. In October 2026, researchers identified serious weaknesses in eight intermediate certificate authority keys associated with the company’s global website-security business. Major browser vendors responded by blocking the affected certificates, and eMudhra subsequently announced its decision to withdraw from the global SSL/TLS certificate business.
For businesses that depend on online identity systems, the episode raises important questions about how digital trust is established, how security controls are independently verified, and what happens when a trusted provider experiences a failure. The implications are not limited to eMudhra. They offer a wider lesson about the infrastructure that supports secure online transactions.
Why Digital Certificates Matter to Business
Digital certificates help establish whether a website, software publisher, or other digital entity can be trusted. In the case of HTTPS websites, SSL/TLS certificates support encrypted connections and help browsers verify that users are communicating with the intended domain. Certificate authorities issue these credentials within a hierarchy of trust that browsers and operating systems recognise.
eMudhra operates in several areas of digital trust, including Indian digital signature certificates, electronic signatures, and international website-security certificates. Although these services share a broad connection to digital identity, they do not all operate through the same trust infrastructure.
That distinction matters when assessing the recent incident. According to eMudhra’s public statements, the weakness affected eight intermediate authorities within its global TLS operation, rather than its root private keys or its separate Indian digital-signature and eSign infrastructure. The company stated that the affected intermediates had not issued end-entity certificates and that it had found no evidence of an infrastructure compromise or data breach.
These details help define the known scope, but they do not make the incident insignificant. A certificate authority occupies a sensitive position in the security ecosystem because browsers rely on its technical controls when deciding which websites to trust.
What Went Wrong With the Certificate Security Process
The incident centred on a key-generation exercise conducted on April 30, 2025. According to eMudhra’s account, a procedural flaw during a cryptographic key-handling step produced an additional set of weak keys alongside the intended strong keys. The weak keys were subsequently associated with intermediate certificates included in browser trust systems. An independent researcher reported the problem on October 17, 2026, and the affected intermediates were revoked the following day.
The significance lies in the quality of the cryptographic keys. A private key must be generated with sufficient randomness to make it computationally infeasible for an outsider to derive it from publicly available information. If that process produces a predictable or unusually small value, the security assumptions supporting the certificate can fail.
Google’s Chrome security team explained that the weakness could have enabled someone to create fraudulent HTTPS certificates capable of impersonating websites on systems that had not yet blocked the affected authorities. Google also reported that no certificates chaining to six affected TLS intermediates appeared in Certificate Transparency records before its blocking action.
That finding is an important limit on what is publicly known about potential misuse, although it does not remove the underlying failure.
The episode also raises questions about quality assurance. eMudhra said the relevant infrastructure had undergone independent audit cycles, yet the defect remained undetected for approximately 18 months.
Audits provide essential oversight, but they cannot guarantee that every implementation error will be identified. Security depends on whether organisations combine formal reviews with technical validation, independent testing, and checks that verify the actual outputs of critical processes.
What Businesses Should Take From the Incident
For organisations using public-facing websites, the immediate priority is to establish whether any active certificates rely on an affected trust chain. Businesses should work with their IT and security teams, hosting providers, and certificate-management partners to inventory relevant certificates, inspect their issuing authorities, and follow the applicable browser and operating-system guidance.
The response should be based on the certificate chain in use, not simply the name of the vendor. A business may use several certificate authorities across different websites, applications, and environments. It should confirm which certificates are affected, obtain replacements from an independently trusted hierarchy where necessary, and test the new configuration before relying on it in production.
This becomes particularly important because browser trust changes can disrupt legitimate websites as well as block malicious certificates. Google announced that removal of the emSign ECC Root CA – G3 from the Chrome Root Store was expected to take effect for devices relying on that store on October 27, 2026, with earlier changes on prerelease channels. Google advised website operators using certificates chained to that root to migrate to another trusted hierarchy.
Businesses should therefore avoid assuming that an existing certificate will continue to work simply because it has not expired. Trust can be withdrawn before the certificate’s printed validity period ends. An expired certificate is not the only reason a browser may reject a connection.
Making Digital Trust More Resilient
The eMudhra incident shows how a failure in a specialised technical process can become a business continuity concern. Certificate security depends not only on strong cryptographic algorithms, but also on correct implementation, reliable key generation, independent verification, effective monitoring, and timely communication when something goes wrong.
For businesses, the appropriate response is neither to dismiss the incident because the known impact was limited nor to assume that every service connected with the company has been compromised. Instead, organisations should verify their exposure, follow authoritative migration guidance, and review whether their own certificate management practices would withstand a similar event.
eMudhra’s experience also reinforces a broader principle: digital trust is maintained through ongoing evidence, not granted permanently by certification or reputation. Organisations that know where their certificates are used, maintain tested replacement procedures, and avoid unnecessary dependence on a single trust provider are better placed to manage future disruptions.
As online identity becomes increasingly important to commerce, government services, and digital transactions, certificate security must remain an operational priority. The lasting value of this episode lies in the questions it prompts businesses to ask now, before another weakness emerges: who vouches for the systems they rely on, how that assurance is verified, and how quickly they can respond if it changes.
