ProteQC flags 100-day certificate migration risk after eMudhra exit

ProteQC says organisations using eMudhra-issued public certificates may face a migration crunch as most of the certificates identified in its analysis expire within 100 days of the Oct. 17 disclosure. The research highlights a mismatch between short certificate lifespans and the longer onboarding timelines many regulated enterprises need to approve a replacement provider.

Why it matters: - ProteQC says the eMudhra market exit could force regulated organisations to replace a certificate authority faster than their procurement, risk and compliance processes usually allow. - The gap matters because a lapse in certificate continuity can disrupt secure website traffic, internal systems and trust relationships. - The research also frames the issue as an early test of post-quantum cryptography readiness, where supplier changes may happen before enterprises are ready.

What happened: - ProteQC released new research on Nov. 3, 2026, examining the impact of eMudhra's withdrawal from the global public certificate authority market. - The analysis followed disclosure of weak cryptographic signing keys in several eMudhra certificate authorities. - ProteQC used public Certificate Transparency logs, domain data and trust-store records to identify 2,629 registrable domains across about 500 organisations with unexpired eMudhra-issued server certificates at the time of disclosure on Oct. 17, 2026.

The details: - Nearly all of the identified certificates, 99.97%, expire on or before Jan. 25, 2027. - Only five identified certificates expire later than that date. - ProteQC says typical supplier onboarding for regulated organisations can take six months or longer because of third-party risk assessments and compliance reviews. - As of Nov. 2, 2026, about 80% of the identified certificates were still unexpired. - Of the organisations that had already replaced a certificate, about three-quarters re-issued with eMudhra's newer certificate generation. - About one-quarter moved to other providers. - ProteQC identified 340 domains with expired eMudhra certificates and no replacement visible in public Certificate Transparency logs. - The firm says that creates a growing certificate-continuity gap as more certificates reach expiry. - ProteQC said the research reflects publicly recorded certificate issuance, not live deployment, and does not mean every identified domain is currently using an affected certificate or facing a security issue.

Between the lines: - The findings point to a mismatch between certificate expiration deadlines and enterprise decision cycles. - Regulated buyers often need more time to complete supplier checks than the remaining life of many of the certificates now in use. - Tim D. Williams, CTO and co-founder of ProteQC, said the lesson extends beyond one provider and that organisations need to be able to replace a cryptographic supplier within a defined timeframe. - ProteQC said the eMudhra case shows how cryptographic transitions can be driven by events outside an organisation's control. - The firm also noted that reduced provider choice and higher migration costs are possible side effects when a trusted CA leaves the market.

What's next: - ProteQC said it is continuing to monitor certificate migration activity. - The firm said it will track whether organisations renew with eMudhra's newer browser-trusted certificate authorities or move to alternative providers. - ProteQC said full methodology, evidence and sources are available on its research page: the company's research page. - The firm said organisations that rely on eMudhra should evaluate future certificate issuance and renewal options immediately. - ProteQC also said it can help organisations plan CA transitions and prepare for post-quantum migration.

The bottom line: - eMudhra's exit may look like a narrow certificate-authority event, but ProteQC says it exposes a broader readiness problem: many enterprises may not be able to swap cryptographic suppliers as fast as their certificates expire.