For businesses in the Philippines relying on digital trust and secure transactions, the recent news of a security incident involving eMudhra’s TLS certificate hierarchy might have raised concerns. The company is now moving to clarify exactly what happened—and what didn’t.
eMudhra (NSE:EMUDHRA) has issued a firm assurance that its services and customer operations in the Philippines remain completely unaffected by a recently disclosed security incident. That incident involved a specific set of intermediate Certificate Authorities within its TLS business, but the company stresses that the impact was narrow and contained.
The problem was limited to eight intermediate CAs tied to one particular Global TLS hierarchy. Critically, none of those affected intermediates had issued any end-entity certificates, and eMudhra’s own investigation has turned up no evidence that its infrastructure or any customer data was compromised.
Also worth a look: Shark Tank UAE proves the country’s startup ecosystem is built for growth, says Letsia chairman and eMudhra reassures MEA clients after global TLS incident, offers free Sectigo certificates.
For customers in the Philippines, the key takeaway is clear: there has been no impact to eMudhra services, including TLS services. The company’s broader portfolio—encompassing emCA, CertiNext, emSigner, SecurePass, and Privatrust—continues to run without interruption. The affected Global TLS hierarchy represents just one specific slice of eMudhra’s overall digital trust business, not its core operations.
It is worth understanding the distinction here: publicly trusted TLS is part of the global WebPKI ecosystem, governed by browser and operating-system root programs. This is a separate domain from the broader PKI, identity, signing, authentication, and enterprise trust infrastructure that eMudhra provides to organizations worldwide.
Once the issue was confirmed, eMudhra moved quickly to contain the damage. The affected intermediate CAs were revoked within hours of confirmation. Simultaneously, the company began working directly with the limited customer ecosystem affected by the resulting root distrust, facilitating replacement certificates and ensuring continuity of service.
Going a step further, eMudhra has made certificates issued by an alternate publicly trusted Certificate Authority available to its TLS customers—including those whose existing certificates were not impacted. This proactive measure is designed to give customers additional CA redundancy, flexibility, and continuity should similar ecosystem-wide events arise in the future.
“There has been no impact to our customers or services in the Philippines, and our commitment to the market remains unchanged,” said Arvind Srinivasan, EVP & Director of eMudhra. “We have a responsibility to be transparent, diligent in our remediation, and to learn from this incident. Our focus now is on strengthening our controls, supporting our customers, and emerging as a stronger and more resilient organization.”
The Philippines remains a strategic market for eMudhra, and the company continues to support local organizations through emCA, CertiNext, emSigner, SecurePass, and Privatrust. These tools help enable trusted digital identities, secure transactions, certificate management, authentication, and paperless digital workflows.
eMudhra maintains a physical presence in Metro Manila and says it remains fully committed to supporting customers, partners, enterprises, and institutions as the Philippines accelerates its digital transformation agenda. The recent Global TLS incident does not alter that commitment.
Looking ahead, eMudhra says it will continue investing in technology, customer support, operational resilience, and digital trust capabilities to help organizations in the Philippines modernize securely and confidently.
Why it matters: This incident underscores the complexity and interdependence of the global WebPKI ecosystem, where a contained issue can still raise broader questions about trust. For businesses in rapidly digitizing markets like the Philippines, the takeaway is that resilience depends not just on preventing every incident, but on having the transparency and infrastructure to respond without disrupting operations.
