eMudhra faces backlash over delayed certificate disclosures

SecurityOnline[.]info reports that Indian certificate authority eMudhra has faced swift backlash after issuing a controversial explanation for delayed forensic disclosures, claiming that intense public scrutiny prevented engineers from conducting meaningful technical inquiries. The piece notes that this justification drew immediate condemnation from major industry players, with Google and Mozilla stating that accountability cannot be avoided and that scrutiny is an expected consequence of trust failures.

The article quotes root store coordinators and references a Bugzilla discussion where Google’s Root Program engineers rejected the excuses and Mozilla analysts urged eMudhra to meet baseline community obligations.

The piece highlights unanswered technical questions raised by browser vendors, including reported inconsistencies in key-generation workflows and cryptographic MRs between certificate revocation lists and root certificates. It also notes investigators’ inquiries into a purported second set of cryptographic keys and calls for verifiable server logs and detailed execution timelines to substantiate claims.

On the business side, SecurityOnline[.]info reports that eMudhra has signalled a withdrawal from the commercial WebPKI certificate market, arguing that TLS certificates contribute less than one per cent of corporate revenue and that negative publicity threatens other ventures. The article suggests that, given the market exit, questions remain about whether eMudhra will ever deliver a transparent audit. The piece attributes claims to Google, Mozilla, Bugzilla discussions, and the company’s own statements as reported by the outlet on 26 October 2026.