Compromised Cryptographic Keys Trigger Global Cybersecurity Concerns

Bengaluru-based digital security company eMudhra announced on October 22 that it would shut down its global Secure Sockets Layer (SSL) and Transport Layer Security (TLS) certificate business following a major cybersecurity incident that raised concerns about internet security worldwide.

The company cited rising compliance requirements, data sovereignty concerns, operational complexity and increasing costs as reasons for the decision. It also said that the recent incident had attracted disproportionate scrutiny of its global operations. The business contributes approximately one per cent of eMudhra’s global revenue and has faced growing competition from providers offering free certificates.

The security lapse involved the exposure of private cryptographic keys associated with eight intermediate digital certificates. These certificates help establish the authenticity of websites and secure online communications. The compromised keys could potentially have been used to create fraudulent certificates, allowing malicious actors to impersonate legitimate websites.

Following the disclosure, major technology companies, including Apple, Google, Microsoft and Mozilla, moved to block the affected certificates. eMudhra’s shares also declined by around 40 per cent over two days following the disclosure.

Company Begins Transition While Indian Services Continue

eMudhra stated that it revoked the affected certificate authorities within 14 hours of discovering the incident. The company maintained that no end-entity certificates had been issued through the affected authorities and that its infrastructure and customer data had not been compromised.

Although there is no clear evidence that the compromised keys were exploited to intercept encrypted internet traffic, cybersecurity experts warned that the incident posed serious potential risks.

The company has stopped issuing certificates under the affected G3 chain and is cooperating with browser companies. It has also committed to publishing a detailed root-cause analysis after completing its investigation.

However, eMudhra clarified that its Indian operations, including digital signature certificates, eSign and enterprise identity solutions, remain unaffected and will continue normally. Its domestic services support government websites and businesses with digital authentication and document-signing requirements.

The incident highlights the importance of strong cryptographic standards, regular security audits and trust in the digital certificate infrastructure that underpins internet security.