A serious cybersecurity incident involving Bengaluru-based digital trust company eMudhra has put the security of internet connections under the spotlight. The company discovered a flaw affecting eight intermediate digital certificate authorities, prompting major technology companies to take protective action. On October 22, 2026, eMudhra announced that it would withdraw from the global SSL/TLS certificate business.

The incident highlights an important aspect of internet security that most users rarely think about: how browsers determine whether a website is genuine and whether a connection can be trusted.

Although eMudhra has stated that its infrastructure was not compromised and no customer data was breached, the incident has raised questions about how a flaw in digital security systems can go undetected despite independent audits.

What Exactly Went Wrong?

The issue involved eight intermediate Certificate Authorities (CAs) associated with eMudhra's global website security business. These certificates were created during a key-generation process on April 30, 2025.

According to the company's statements, a software script error resulted in weak cryptographic keys being generated alongside the intended strong keys. The weak keys were subsequently published within browser trust systems.

Cryptographic keys are fundamental to digital security. They help establish trust between websites and visitors, ensuring that users are communicating with the intended website rather than an impostor.

If an attacker can recover a certificate authority's private key, they may be able to create fraudulent certificates that appear legitimate to systems that still trust the compromised authority. Such certificates could potentially be used to impersonate websites or undermine secure connections.

An independent security researcher reported the weakness in October 2026. Following the discovery, eMudhra revoked the affected intermediate certificates, and major browser companies moved to block or distrust the affected certificate hierarchy.

Why Did Google, Apple and Microsoft Take Action?

Modern browsers rely on trusted certificate authorities to verify the identities of websites using HTTPS. This system helps protect information exchanged between users and websites.

When a certificate authority is found to have a serious security weakness, browser developers must decide whether certificates issued under that authority can continue to be trusted.

Google, Mozilla, Apple and Microsoft took action following reports about the affected eMudhra certificates. Google's Chrome security team also announced measures to remove trust in the affected certificate hierarchy, with changes scheduled to roll out across devices.

These steps are intended to prevent browsers from accepting fraudulent certificates associated with the compromised keys.

The response demonstrates how technology companies can coordinate to reduce security risks across the internet. However, systems that do not receive security updates promptly may take longer to apply protective changes.

Were Users' Passwords and Banking Details Exposed?

One of the biggest concerns following a cybersecurity alert is whether personal information has been stolen.

As of October 26, eMudhra has stated that its infrastructure was not compromised and no customer data was breached. The company also said that the affected intermediate authorities had not issued publicly trusted end-entity certificates.

That distinction is important. The incident involved the ability to recover weak private keys, creating a potential risk of fraudulent certificate issuance. It does not, by itself, establish that attackers intercepted banking transactions, stole passwords or accessed personal accounts.

The company's Indian digital signature and eSign services operate on separate infrastructure and were reported to be unaffected. Its other specified enterprise services were also reported to be operating normally.

Nevertheless, the incident is a reminder that users should keep browsers and operating systems updated, particularly when security changes are released to address newly discovered vulnerabilities.

Why Is eMudhra Exiting the Global SSL/TLS Business?

On October 22, eMudhra announced that its board had decided to voluntarily withdraw from the global SSL/TLS certificate business.

The company said this business accounted for approximately 1% of its global revenue. It also cited rising compliance requirements, operational complexity, costs and reduced commercial opportunities.

The security incident has added pressure to a business in which trust is essential. Certificate authorities must demonstrate that their key-generation procedures, internal controls and verification systems meet demanding security standards.

The company has said it will help affected customers transition to alternative certificates without charge. It is also working with browser trust programmes and has committed to publishing a root-cause analysis.

The exit concerns its global website certificate business, not its entire digital security operation.

What Is an SSL/TLS Certificate, and Why Does It Matter?

SSL/TLS certificates help browsers verify website identities and establish encrypted connections. Although SSL is the older term, TLS is the modern protocol used to secure most HTTPS connections.

When you visit a website beginning with HTTPS, your browser checks its certificate as part of establishing a secure connection. A padlock or similar security indicator generally means the connection is encrypted, but it should not be treated as proof that a website itself is honest or free from scams.

Certificates help protect information such as login credentials and payment details while they travel between a device and a website. They also make it harder for an attacker to impersonate a legitimate website under normal circumstances.

However, this protection depends on the security of the wider certificate system. If a trusted certificate authority issues or supports a compromised certificate, browser vendors may need to revoke that trust to prevent misuse.

What Can Businesses Learn From This Incident?

The eMudhra case offers several important lessons for organisations that depend on digital certificates.

1. Automated checks are essential

Critical cryptographic processes should include independent validation to ensure that generated keys meet security requirements. A script completing successfully does not necessarily mean its output is safe.

2. Audits must test real-world security

Independent audits are valuable, but organisations also need robust technical controls, continuous monitoring and verification of sensitive operations. The incident raised questions because the flaw reportedly remained undetected through two audit cycles.

3. Alternative certificate providers can reduce disruption

Businesses that rely on digital certificates should understand which certificate authority supports their websites and services. Having a planned migration route or an appropriate alternative can help reduce downtime when trust changes unexpectedly.

4. Security updates cannot be ignored

Browser and operating-system updates can include changes to certificate trust lists. Delaying updates may leave systems without important protections against newly identified threats.

The Bottom Line

The eMudhra incident is a reminder that internet security depends on more than passwords, antivirus software and encrypted connections. It also relies on a complex system of trusted organisations, secure key generation and continuous verification.

The company says it has revoked the affected certificates, that no customer data was breached and that its Indian digital signature and eSign services remain unaffected. Its decision to leave the global SSL/TLS certificate business reflects the seriousness of the incident and the importance of maintaining confidence in digital trust systems.

For everyday users, the practical advice remains simple: keep devices and browsers updated, check website addresses carefully, avoid suspicious links and never assume that HTTPS alone guarantees a website is legitimate. For businesses, the incident reinforces the need to verify their certificate dependencies and maintain a clear plan for responding to security failures.