Every TLS contract needs a forced-reissue clause and a second CA after eMudhra

The private key for one of eMudhra's intermediate certificate authorities was the number 4. A P-384 elliptic-curve key is supposed to carry 384 bits of randomness. The eight keys in question came out as 4, 56, 66, 115, 155, 156, 230 and 237. They had been sitting there since April 2025, roughly 18 months, and BleepingComputer reports that attackers could have recovered them at any point in that time, though there is no evidence anyone did.

I expected the familiar sequence after that: a sheepish incident report, weeks of argument with the browser root programmes, a CA that limps on with a probation note in its file. Instead eMudhra's board walked away from global SSL/TLS on 22 October, five days after the report landed. Chairman V. Srinivasan said the line brought in about 1% of revenue, was getting costlier to run under sovereignty and compliance rules, and competed against large players who give certificates away. He also complained that the online attention was "out of proportion to SSL/TLS's place in our business".

Read that as a buyer. Your supplier has just told you that the thing keeping your website and your APIs reachable was a rounding error it could drop after one bad week. I don't blame the board. A line worth 1% of revenue that carries most of the reputational risk is a poor trade for shareholders. But it tells you how little incentive a diversified vendor has to fight for its root, and buyers should price that in.

The browsers also moved faster than any contract could. Mozilla received the report at 20:06 UTC on 17 October and had the certificates blocked through OneCRL by 22:59 UTC. eMudhra's own revocations came the next morning, between 09:24 and 09:38 UTC. Google and Mozilla then moved to strip trust from the entire emSign ECC Root CA G3, because some clients do not reliably enforce revocation of intermediates. Apple, Microsoft and Android followed within days. Go shipped versions 1.27.3 and 1.26.10 to reject the keys, which protects only the apps that get rebuilt. Sectigo, which had cross-signed the eight intermediates, revoked those cross-certificates about 25 hours after eMudhra acted, so a second CA's chain was dragged into the cleanup.

I think the lesson for procurement is blunt. A TLS certificate is worth something only while Apple, Google, Microsoft and Mozilla keep trusting whoever signed it. Your negotiated price and your SLA stop mattering the moment a root programme acts, and none of those four companies is a party to your contract.

eMudhra's defenders have a fair case. None of the eight intermediates ever issued an end-entity certificate. The company says its infrastructure was not compromised and no data was breached. Its G1 RSA roots keep serving customers through the transition, partners will replace certificates free of charge, and revocation services will run until the last certificate expires. A customer who did nothing this month will probably be fine.

My reply is that every one of those comforts was luck or goodwill. Customers came out whole because the broken intermediates happened to be unused and because the vendor chose to be generous on its way out of the market. None of it was written into a contract. Palo Alto Networks' Unit 42 told anyone holding certificates under the affected intermediates to revoke immediately and reissue through a different, fully trusted CA. In plain terms, customers had to find another supplier that day.

So write it down. Every certificate contract, renewals included, should carry a forced-reissue clause: if any major root programme distrusts, restricts or announces removal of a root or intermediate in your chain, the vendor replaces your certificates at its own cost through a named alternative CA inside a window you specify, and you may terminate with a pro-rata refund. Set that window against what this incident showed. Mozilla needed under three hours to block. eMudhra needed 14 hours to revoke. A vendor that won't commit to replacing your certificates within a day is asking you to carry its risk for free.

Then keep a second CA live. Open an account with an unrelated CA, get your organisation validated before you need it, point your automation at it and issue from it on a real but low-stakes hostname so you know the path works. Check that the two vendors don't quietly share a chain through cross-signing; Sectigo's revocations showed how two brands can end up tangled in one incident. For domain-validated certificates the free issuers the chairman grumbled about make a backup almost costless. For OV and EV, it means a second contract, which is cheap next to an outage that reaches every Android phone.

Before your next renewal, pull your certificate inventory and group every certificate by the root it chains to. If one root carries your login page, your payments API and your app backend, send your CA the clause above this week, and if it won't sign, start onboarding the second CA this quarter.

Prompted by eMudhra to Exit global SSL/TLS Certificate Business, emudhra.com.