Do Son 
Indian digital trust provider eMudhra recently issued a controversial explanation regarding its delayed forensic disclosures. Surprisingly, company management claimed that intense public scrutiny prevented engineers from conducting meaningful technical inquiries. This justification provoked immediate condemnation from internet security leaders. Specifically, representatives from Google and Mozilla accused the certificate authority of evading basic accountability.
Scrutiny Cannot Excuse Missing Audit Reports
For weeks, root store coordinators requested comprehensive technical post-mortems on public tracking forums. In a formal critique within the Bugzilla incident discussion on eMudhra root certificates, Google Root Program engineers rejected these excuses. Google emphasized that intense industry scrutiny represents an expected consequence of trust failures. Furthermore, Mozilla analysts echoed these concerns, demanding that eMudhra satisfy baseline community obligations.
Public commentary cannot hinder technical teams from inspecting internal infrastructure. Engineers can readily analyze key-generation scripts, operator audit trails, and hardware security module logs. Therefore, attributing operational delays to external criticism reveals an alarming corporate mindset. The organization seemingly prioritizes public relations optics over transparent forensic discovery.
Unanswered Technical Questions from Browser Vendors
Meanwhile, major browser maintainers outlined specific technical anomalies requiring immediate clarification.
Critical Inconsistencies in Key Generation Workflows
First, auditors demanded to know why cryptographic mismatches between certificate revocation lists and root certificates went uninvestigated in 2025. In addition, investigators asked why previous incident reports concealed an undisclosed second set of cryptographic keys. Answering these vital questions requires verifiable server logs and detailed execution timelines. Certificate authorities serve as foundational pillars for global internet encryption. Consequently, abandoning transparency severely compromises global digital security.
Commercial Exit Prioritizes Profit Over Integrity
Recently, eMudhra announced plans to withdraw entirely from the commercial WebPKI certificate market. However, the company emphasized that TLS certificates generated less than one percent of corporate revenue. Furthermore, leadership noted that negative publicity threatened broader commercial ventures. This defensive retreat suggests that financial interest eclipsed responsible stewardship. With the provider preparing its market exit, security researchers question whether eMudhra will ever deliver an honest audit.
Support Our Threat Intelligence
Find our tech and OS security coverage helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
