ProteQC Research: eMudhra Exit Leaves Organisations Facing a 100-Day Certificate Migration Challenge

Analysis identifies 2,600+ domains with unexpired eMudhra certificates, showing a gap between certificate expiration deadlines and supplier onboarding timelines

LONDON, UNITED KINGDOM, November 3, 2026 /EINPresswire.com/ — ProteQC, a vendor-neutral post-quantum cryptography (PQC) advisory firm, today released new research revealing that organisations relying on eMudhra’s public certificate services could face a significant challenge as existing certificates approach expiration, potentially faster than regulated enterprises can approve and onboard alternative providers.

Following the disclosure of weak cryptographic signing keys in several of its certificate authorities, eMudhra announced its withdrawal from the global public certificate authority (CA) market. While the original security flaw appears to have affected very few subscribers, ProteQC’s independent analysis reveals that the broader market exit could create operational challenges for organisations that depend on its certificate services.

Using publicly available Certificate Transparency logs, domain data and trust-store records, ProteQC identified:

– At least 2,629 registrable domains across approximately 500 organisations held unexpired eMudhra-issued server certificates at the time of disclosure on October 17, 2026

– Approximately 100 days: Virtually all of the identified certificates (99.97%) expire on or before 25 January , 2027, within 100 days of the 17 October 2026 disclosure, based on ProteQC’s analysis of public Certificate Transparency records. Only five expire later.

– Six months or longer: In ProteQC’s experience, a typical supplier onboarding timeline for regulated organisations that must complete third-party risk assessments and compliance reviews.

– An emerging certificate-continuity gap: As of 2 November, 2026, approximately 80% of the identified certificates remained unexpired. Of the organisations that have so far obtained a replacement, around three-quarters re-issued with eMudhra’s newer certificate generation and around one-quarter moved to other providers. However, 340 domains whose eMudhra certificates have already expired show no replacement certificate in public Certificate Transparency logs, a potential loss of certificate continuity that grows as further certificates reach expiry.

These findings demonstrate a potential mismatch between certificate expiration deadlines and the time organisations may need to establish relationships with alternative providers.

A CERTIFICATE MIGRATION CHALLENGE FOR REGULATED ORGANISATIONS

Replacing a certificate authority is not always as simple as purchasing a new certificate. For organisations in regulated industries, transitioning to a new provider may involve procurement approvals, third-party risk assessments, compliance reviews and changes to established security processes. While remaining eMudhra certificates continue to validate, organisations that rely on their services must evaluate their future certificate issuance and renewal options immediately.

“The lesson here goes far beyond one certificate provider,” said Tim D. Williams, CTO and co-founder of ProteQC. “Organisations need to be able to replace a cryptographic supplier within a defined timeframe, not discover during a crisis that their internal processes take longer than their certificates have left to run. That same capability will be essential as businesses prepare for the transition to post-quantum cryptography.”

A REAL-WORLD WARNING FOR POST-QUANTUM READINESS

The research findings highlight a broader challenge facing enterprises as they prepare to transition to post-quantum cryptography. As cryptographic standards evolve, organisations will need to identify and replace cryptographic technologies, manage dependencies across external providers and coordinate migrations without disrupting business operations.

The eMudhra situation provides a real-world example of how cryptographic transitions can be driven by events outside an organization’s control.

For organisations that lack visibility into its certificate dependencies or established processes for onboarding alternative providers, unexpected changes like the eMudhra’s exit can create significant operational pressure.

THE IMPORTANCE OF MAINTAINING DIGITAL TRUST

ProteQC recognizes eMudhra’s transparent response to the original security disclosure and acknowledges the importance of accountability within the global certificate authority ecosystem. However, its independent research emphasizes the wider implications of a trusted provider leaving the market, including potential migration costs, reduced provider choice and increased reliance on remaining certificate authorities.

ProteQC has offered to contribute to an independent evaluation of these considerations, while recognizing that only eMudhra and the relevant trust authorities can determine whether continued operation is appropriate.

INDEPENDENT RESEARCH AND NEXT STEPS

ProteQC’s findings are based exclusively on publicly available information, including Certificate Transparency logs, domain data and public trust-store records. The firm continues to monitor certificate migration activity to understand how organisations are responding to eMudhra’s market withdrawal.

Early findings indicate that most organisations with observed certificate renewals have remained with eMudhra’s newer, browser-trusted certificate authorities, while a smaller number have transitioned to alternative providers. However, most of the identified certificate estate has yet to show evidence of renewal or replacement.

The analysis reflects publicly recorded certificate issuance rather than live deployment and does not indicate that every identified domain is currently using an affected certificate or experiencing a security issue.

Full research methodology, supporting evidence and sources are available on ProteQC’s research page.

As an independent vendor-neutral advisory firm, ProteQC helps organisations navigate certificate authority transitions, from identifying cryptographic dependencies and selecting alternative providers to certificate re-issuance and supplier readiness assessments. The firm also supports organisations preparing for post-quantum migration, helping them build the cryptographic agility needed to respond to both planned and unexpected changes.

For more information or guidance, visit proteqc.com or contact info@proteqc.com.

About ProteQC
ProteQC is a vendor-neutral post-quantum cryptography (PQC) advisory firm enabling organisations to achieve crypto-agility and mitigate quantum-era risk. The firm delivers training, assessments, strategy development, and ongoing advisory support to financial institutions, healthcare providers, critical infrastructure operators and their extended supply chains.

press@proteqc.com
Ana Perez Quiles, Chief Marketing Officer
ProteQC

Media gallery