The fallout from a recent security incident involving a set of intermediate Certificate Authorities (CAs) in eMudhra’s Global TLS business has prompted the company to issue a clear reassurance to its clients across the Middle East and Africa: no customers, services, or applications in that region have been affected. For organizations relying on digital trust infrastructure, the distinction between a contained global issue and a regional disruption matters deeply.
eMudhra today confirmed that the recently disclosed security incident involving a specific set of intermediate Certificate Authorities within its Global TLS business has had no impact on any eMudhra customer, service or application across the Middle East and Africa.
This assurance covers not only eMudhra’s TLS certificate services in the region but also its entire enterprise technology portfolio, which includes emSigner, emCA, CertiNext, SecurePass and Privatrust. According to the company, all of these platforms continue to operate normally without any disruption.
Also worth a look: UAE’s streamlined business rules are a global benchmark, says Letsia Holding chairman and PrintSheetLab launches free math calculators that show every step, plus printable base ten blocks.
The incident itself involved eight intermediate CAs associated with a specific Global TLS hierarchy. Critically, none of those intermediates had issued end-entity certificates, and eMudhra’s investigation has found no compromise of its infrastructure or customer data.
The impact arising from the subsequent distrust of the affected hierarchy has been confined to a single customer ecosystem in the United States. There has been no impact whatsoever to eMudhra’s TLS customers across the Middle East and Africa.
Accordingly, no action is required from customers in the region in relation to their existing infrastructure, TLS deployments or any eMudhra-provided enterprise application as a result of this incident.
Additional CA redundancy for customers
While customers across the Middle East and Africa have not been impacted, eMudhra is taking additional steps to further strengthen customer resilience around its TLS offerings.
eMudhra is making Sectigo-issued TLS certificates available as an alternate option at no additional cost, including to customers whose existing certificates are completely unaffected by the incident.
This is a proactive CA redundancy measure, rather than a remediation requirement for customers in the region.
By enabling customers to maintain certificates from more than one independently operated publicly trusted CA, eMudhra aims to provide additional flexibility and business continuity in the event that any individual CA hierarchy experiences a future revocation, distrust or other ecosystem-level event.
Root-cause analysis and remediation underway
eMudhra is conducting a comprehensive investigation into the incident, including a detailed review of the key-generation process, associated operational controls, governance and the circumstances that allowed the issue to remain undetected.
The company is developing a broader remediation program based on the findings of this review and will publish its root-cause analysis and relevant remediation measures to appropriate stakeholders in due course.
eMudhra is also continuing to engage transparently with browser and root-store programs and the broader WebPKI community throughout this process.
All confirmed updates relating to the incident, its scope, customer impact and remediation are being maintained at: https://emudhra.com/en/post/certificate-security-incident
Responsibility, transparency and resilience
eMudhra recognizes that operating digital trust infrastructure carries a particular responsibility.
The company believes that responsibility extends beyond addressing the immediate technical issue. It requires being transparent about what happened, communicating clearly about what is and is not affected, supporting customers proactively, conducting a thorough root-cause analysis and applying the lessons learned to strengthen controls across the organization.
eMudhra has therefore focused its response on rapid containment, continuity for the limited affected customer ecosystem, additional resilience for customers who were not impacted, and a comprehensive review intended to ensure that the organization emerges from the incident stronger and more resilient.
“I apologise for the concern this incident may have caused our customers and partners across the region. There has been no impact to any of our customers or services across the Middle East and Africa, including our TLS services and enterprise platforms. Our responsibility is to remain transparent, diligent in our remediation and proactive in strengthening resilience for our customers. We are committed to learning from this incident and emerging as a stronger organization.” — Arvind Srinivasan, EVP & Director, eMudhra
Continued commitment to the Middle East and Africa
The Middle East and Africa remain strategically important markets for eMudhra and central to the company’s long-term commitment to enabling trusted digital transformation.
Through emSigner, emCA, CertiNext, SecurePass and Privatrust, eMudhra supports governments, financial institutions and enterprises across the region with technologies that enable digital signatures, enterprise PKI, certificate lifecycle management, identity, authentication and trusted digital transactions.
The recent Global TLS incident does not affect these platforms, eMudhra’s services in the region or the company’s commitment to its customers and partners.
eMudhra will continue investing in local capability, technology, customer support, security, resilience and digital trust infrastructure across the Middle East and Africa.
About eMudhra
With over 17 years of expertise, eMudhra is a global provider of digital identity, trust, and security solutions, enabling secure digital transformation for banks and financial institutions (BFSI), enterprises, and governments across more than 35 countries worldwide. Its product suite spans CertiNext (PKI and certificate lifecycle management), SecurePass (identity and access management, multi-factor authentication and converged identity), and PrivaTrust (data discovery and consent management for global data-privacy compliance and DSARs), delivering high-assurance digital trust at population scale.
Sudesh Kumar
eMudhra
sudesh.k@emudhra.com
Visit us on social media:
LinkedIn
Why it matters: This incident underscores the fragility of global digital trust infrastructure and the importance of proactive resilience measures. For enterprises across the Middle East and Africa, eMudhra’s rapid containment and offer of redundant TLS certificates from Sectigo highlight how even unaffected customers can benefit from strengthened security postures. The broader lesson is that transparency and redundancy are becoming non-negotiable in an era where a single CA misstep can ripple across continents.
