The Exit: A CA Leaves the Business It Broke

Five days after the disclosure, eMudhra's board voted to exit the global SSL/TLS business entirely — a segment worth about 1% of its global revenue, but the source of a government probe, a 20% share-price fall, and a permanent loss of trust. Chrome's removal of the emSign ECC Root CA – G3 on October 27 turned replacement from good practice into a deadline: legitimate certificates chaining to that root stopped working in Chrome.

Key facts

October 22, 2026: eMudhra's board announces exit from the global SSL/TLS business in a BSE/NSE filing; chairman V. Srinivasan cites the incident's handling (affected CAs revoked within 14 hours, no infrastructure compromise or data breach), plus data-sovereignty requirements, rising complexity, and free SSL/TLS offerings from large competitors.
The exited segment contributed about 1% of eMudhra's global revenue; the company absorbs customer certificate-replacement costs and says its G1 RSA roots will serve customers through the transition.
October 27, 2026 (PDT): Chrome removes the emSign ECC Root CA – G3 from the Chrome Root Store; Google warns some legitimate certificates chaining to this root will cease to function in Chrome as a result.
India's Ministry of Electronics and IT constituted a special team to investigate; CERT-In's advisory and the probe followed eMudhra's disclosure.
October 22: eMudhra shares fell about 20% to a 52-week low (NSE: down 19.91% to ₹346; BSE: down 19.63% to ₹346.85), erasing roughly ₹1,300 crore in market value.
eMudhra promises a full root-cause report to browser root programs as part of its remaining commitments; the incident's community-maintained record is the site run by Mozilla's Dennis Jackson.