New Delhi: The application arrived at Mozilla in early 2018 with a description of a company that, by its own account, was “a critical partner to Digital India”.
eMudhra, a Bengaluru firm, wanted Firefox to trust the certificates it issued, the digital credentials that tell a browser a website is genuine. In the paperwork it filed, the company said it handled digital signatures for India’s income tax, GST, customs and company law filings. It said it had issued 35 million certificates, which it described as 3 percent of India’s population. Its certificate software, it said, was “used by the Indian Army and other defence establishments”.
The volunteers who review such applications on Mozilla’s public forum were less certain.
“I have never heard of this entity before,” Nick Lamb, a regular contributor, wrote that October. He asked who was behind the company and whether it had a record anyone could examine. Running a certificate authority was hard, he wrote. He was sceptical that people he had never heard of could “wake up one morning” and do it well.
Two months later, Mozilla approved the company. eMudhra became the only Indian business whose certificates were trusted by every major web browser.
This week, that trust was withdrawn when it was found that the security mechanism associated with the certificates issued by the Bengaluru-based digital cybersecurity firm—now at the centre of a controversy—was compromised.
On 17 October, a researcher found that eight of eMudhra’s private keys (secret numbers that give a certificate its authority, which are meant to be random and about 115 digits long) were numbers below 256; one was the number 4. Google, Mozilla, Apple and Microsoft blocked the eight eMudhra certificates linked to those keys.
Mozilla removed one of the four roots it had approved in 2018, and Google will do the same Tuesday. A root is the master certificate at the top of a chain of trust; a browser trusts every certificate it vouches for. The eight weak certificates were already blocked between 17 and 20 October, so users are protected from them. Removing the root is a further step to cover devices that do not receive such blocks. Chrome’s removal takes effect when its next root store update reaches devices on 27 October.
On Thursday, eMudhra said it would exit the global website certificate business altogether.
The company’s own words—in its 2018 application, in its posts to Mozilla’s forums and bug tracker, and in its filings in India—show how it won trust, and what reviewers questioned along the way. Corporate records add something else. They show a company controlled by one family, whose control traces to a 2010 sale that eMudhra’s former parent company now says was fraudulent.
‘Not a complete Webtrust audited setup’
Browsers had reason to be cautious about India. In July 2014, the National Informatics Centre, a government agency operating under the country’s official certificate root, issued unauthorised certificates for Google’s domains. Google restricted that root to a handful of Indian domain endings.
eMudhra’s pitch drew on that same government system. It said it had been licenced for more than a decade by the Controller of Certifying Authorities (CCA), the regulator under the Ministry of Electronics and Information Technology that licences companies to issue digital signatures in India and operates the country’s government root. The National Informatics Centre is one of the agencies licenced under it.
The CCA, eMudhra wrote, is the body “which operates the Indian Government Root”. Matt Palmer, another forum contributor, said the sentence did not make clear who had run the root, and that he could find nothing on how it worked.
When Lamb pressed for the company’s record, an eMudhra representative replied. “We have been operating PKI since last 10+ years in India”, the representative wrote, referring to public key infrastructure, the system of keys and certificates used to verify identities online. “But this was not a complete Webtrust audited setup. Rather, it is under the Government of India.”
WebTrust is the audit standard browsers require. The new roots, the representative said, were “separate from our Indian CA setup”, referring to its Indian certificate authority business.
Srikanth L., who runs the consumer-rights platform CashlessConsumer and tracks the web addresses of Indian banks, said the company’s claims should have been tested. “That’s on Mozilla, they could have done better,” he said.
Mozilla’s reviewer at the time, Wayne Thayer, had found eight problems with eMudhra’s practice document, the rulebook a certificate authority publishes. One clause allowed the company to issue a certificate for a website even when the site’s owner had not authorised it.
“If eMudhra has been in the CA business for 10 years, but they still managed to produce a CPS with the extensive list of ‘Bad’-grade practices you enumerated… that’s… not encouraging,” Palmer wrote, referring to the certification practice statement, the practice document Thayer had reviewed.
A third contributor noticed that eMudhra’s website offered a certificate product that industry rules prohibit. “That’s an unfortunate design issue. We acknowledge the mistake!” the company replied. It called the website a “coming soon” page.
On Mozilla’s bug tracker, the company asked Thayer to open the public discussion before it had fixed his concerns. Its practices, it said, “already adhere to these”. Thayer declined. “I do not think it is productive to begin a discussion with changes imminent,” he wrote.
Kathleen Wilson, who managed Mozilla’s root store, recorded repeated errors from eMudhra’s certificate status server. “Sorry to notice this!” the company wrote back.
Wilson also asked whether Mozilla should limit the roots held by eMudhra’s Indian company to certain domain endings, as Google had done with the government root.
“Not really,” the company replied. “The Indian entity also operates among several geographies and doesn’t constrain to Indian geography.” eMudhra later asked Mozilla to change its listed focus from India to global.
eMudhra revised its documents and submitted audits. Mozilla approved four roots in December 2018. One of those, emSign ECC Root CA-G3, is the one being removed this week.
A sale and a family
eMudhra was born in Mumbai on 16 June 2008, as 3i Infotech Consumer Services Limited, a subsidiary of 3i Infotech, the IT company formerly known as ICICI Infotech. It received its government licence the same year, according to its prospectus.
3i Infotech was run by Venkatraman Srinivasan, a chartered accountant and former ICICI official. In December 2010, it sold the subsidiary to a company called Indus Innovest, promoted by Ravi Jagannathan.
Records filed with India’s Ministry of Corporate Affairs show that Srinivasan’s son, Kaushik Srinivasan, was a director at Indus Innovest from 9 December 2010, to 7 February 2011, the weeks in which the sale went through. The records list Venkatraman Srinivasan himself as a director of Indus Innovest from September 2012, and his wife, Mythili, and Kaushik from September 2014.
On a call with investors in February this year, Venkatraman Srinivasan said he had stayed on as non-executive chairman of the company after the sale, and that at the end of 2013, “this eMudhra part came to me”. He said, “I was not the owner of Indus Innovest at that time,” and that Jagannathan “is not at all related to me”.
That month, 3i Infotech, under new management, filed a police complaint accusing eMudhra, Srinivasan and Jagannathan of fraud and cheating worth more than Rs 128 crore, about $15 million. eMudhra called the accusations baseless and said they were barred by limitation, meaning the legal deadline for bringing such a complaint had passed. In August, the police closed the complaint, calling it a civil dispute.
“When 3i Infotech, another listed company, filed this, nobody noticed,” Srikanth said, referring to the complaint, which 3i Infotech disclosed to the stock exchanges. “There was no scrutiny, and eMudhra has by and large been a monopoly in the Indian Digital Signature Certificates market.”
Today the Srinivasan family and Taarav, a Singapore company in which Venkatraman Srinivasan is a director, control 54.4 percent of eMudhra, which listed on Indian exchanges in 2022. Srinivasan holds 17.36 percent, his wife 15.4 percent and Taarav 16.72 percent. Their sons, Arvind and Kaushik, sit on the board. The company’s largest sales agent before its listing was Bluesky Infotech, a Chennai firm that belongs to the promoter group, according to its prospectus.
Built on paperwork
Most of eMudhra’s money is made at home. Indians need a digital signature certificate to file company forms, tax returns and bids for government contracts, and a market study in eMudhra’s prospectus put its share of that business at 37.9 percent.
In 2015, it became the first company to offer Aadhaar-based eSign. In that service, a person enters a one-time password linked to their national ID, and the provider creates a signing key on its own systems and signs for them.
Many of these certificates are sold to small businesses through agents. On Google, eMudhra’s offices in Chennai and New Delhi have ratings of 3.1 out of 5. Customers most often write that calls went unanswered once they had paid, and that certificates they paid for could not be downloaded. These complaints concern customer service in buying and setting up certificates, and are unrelated to this month’s key compromise. The government has said the compromise did not affect the digital signature and eSign services.
The company used its global standing to expand into the United States. It bought stakes in companies in Houston and Austria and, this year, won the business of InCommon, which issues security certificates to American universities. Of the 30,800 certificates under the root Chrome is removing, Google counted 30,791 from InCommon. The universities have until Tuesday to replace them. These certificates were not issued using the weak keys, and remain valid until Chrome withdraws trust in the root on 27 October. After that, they will stop working in Chrome.
Indian banks also currently rely on eMudhra. At least seven, including Bandhan Bank, Bank of India and Jammu and Kashmir Bank, serve eMudhra certificates on their websites and net banking services, according to a scan of the .bank.in domain by CashlessConsumer.
None are linked to the root being removed this week, but they will be affected if Google also withdraws trust from eMudhra’s remaining root, which it is reviewing. Certificates have also been issued to Canara Bank, Punjab National Bank, Central Bank of India and Indian Bank, among others, but are not yet in use.
eMudhra reported revenue of Rs 701.6 crore, about $84 million, last fiscal year, a third of it from North America, according to its 2025-26 annual report, which puts North America’s share at 34 percent. However, it now says the global certificate business is about 1 percent of total revenue.
‘Human errors in multiple steps’
The secret keys that failed this month were created at a ‘key generation ceremony’ on 30 April 2025. The term is the industry’s name for a formal, recorded procedure, usually witnessed by auditors, in which a certificate authority creates its keys inside secure hardware.
In 2025, an outside party reported to Mozilla that lists eMudhra publishes of cancelled certificates, known as revocation lists, carried signatures that browsers could not verify. The lists were for six new certificates. eMudhra told Mozilla it had signed them with “the wrong private key”, corrected them, and Mozilla closed the report. No customer certificates had been issued from the six. This month, eMudhra told Mozilla it had corrected the lists by signing them again with the weak keys. Those six certificates were among the eight that failed.
On Mozilla’s tracker this week, an eMudhra official, Naveen Kumar ML, wrote that the team that conducted the ceremony had “more than a decade of experience”. Regarding the hardware, he wrote, “doesnt look like the device is at fault”. A software script had created a second, weak set of keys, he said, which staff used “by mistake” because the names were similar.
“There were human errors in multiple steps of the process,” he wrote. He said eMudhra had checked its other keys and found them sound, “corroborated primarily using mathematical models facilitated by AI”.
Dennis Jackson, a Mozilla engineer, wrote that because anyone could recover the keys, “the impact of this incident could not be higher”.
In India, the Ministry of Electronics and Information Technology (MeitY) has formed a team to investigate. Senior officials said the business that failed was audited by an international firm and that “MeitY is not involved in its audit.” The digital signature and eSign services it licences, they said, were unaffected. But that assessment comes from eMudhra; the government’s certifying regulator has not said whether it has checked.
A cyber security researcher, who asked not to be named, said the question now goes beyond website certificates. “If you’ve made this mistake once, the question is about processes and trust,” the researcher said. “There has to be a no-holds-barred review of the entire company’s operations from a technical standpoint, and it has to be fully transparent.”
In 2018, eMudhra told Mozilla that its Indian business ran under the government and its new roots stood apart. This week, the government said the same thing.
ThePrint has reached out to eMudhra through the press enquiry form on its website, as no media contact was listed, and has not got a response so far. This report will be updated as and when we get a response.
(Edited by Viny Mishra)
Also read: MeitY sets up team to probe eMudhra certificate breach, says digital signature services unaffected