eMudhra's exit from public TLS is an inconvenience. Handled well, it is also a useful rehearsal. If you hold eMudhra certificates, the clock is already running.

If you use eMudhra TLS certificates, you may have questions about replacement options, timing, and the impact on your website and applications. Keeping services running is the priority, and DigiCert can help you plan the transition.   

As eMudhra leaves the public TLS certificate business, customers will need to move their publicly trusted TLS certificates to another certificate authority. Google and eMudhra have published information to help customers understand which certificates are affected. eMudhra says its digital signature, eSign, and enterprise products remain unaffected. 

You don’t have to navigate the change alone. DigiCert and our authorized partners can help you evaluate replacement certificates, understand validation requirements, and plan deployment and testing around your deadlines. 

The first step is simple: find out what you have. Contact DigiCert and we will help you assess your environment and plan the replacement of your eMudhra certificates.

Step 1: What to consider before moving

A successful transition starts with understanding your existing environment. Before replacing certificates, identify:

1. What needs to move: Your certificates, domains, applications, and relevant replacement deadlines.
2. Who owns the work: The teams responsible for purchasing, validation, installation, and testing.
3. What needs to change: Certificate chains, custom integrations, and automated renewal processes.
4. How to verify the transition: Checks to confirm that replacement certificates work across your websites, applications, and devices.

Many organizations will find the answers uncomfortable. That is not because they lack automation. According to a comment on Bugzilla, 97% of the affected certificates were issued through ACME, the standard protocol for automated renewal. Yet ACME clients are built for the calm of routine: they renew shortly before a certificate expires. Revocation keeps no such timetable. Replacing a certificate on short notice requires either a management system that can trigger the ACME client or a human who will do it by hand. Switching to a different issuer adds further wrinkles.

If you cannot address the four considerations above with confidence, that is the signal to act.

Step 2: Start replacing the certificates that need replacement now

The work is less mysterious than it looks, and the process is the same whichever CA is chosen.

• Find everything. Build an inventory of eMudhra-issued certificates and map each to its application. DigiCert Trust Lifecycle Manager can automate this discovery.
• Name an owner. A certificate that belongs to no one is the one that expires on a Friday evening. Every certificate needs an owner or should be assigned one.
• Automate the swap. Connect issuance to deployment, including the ability to trigger ACME for unplanned replacements. 
• Verify. Confirm that new certificates are installed and trusted.
• Keep what works. If you are using eMudhra for signing or other non-TLS services, you need not disturb them now but come back when you have figured out your larger strategy.

Steps one and two should begin immediately if not already started.

Step 3: Revisit your PKI strategy

Once you have the immediate remediation under control, you should look at the bigger picture. Don’t put it off and don’t wait for the next incident. Here are some things to consider in your strategic analysis.

The cheapest certificate is rarely the cheapest

A certificate is among the smallest line items in any technology budget. An outage caused by one is among the largest. When a certificate expires or is revoked without a replacement ready, the failure can take down payment systems, customer portals, and internal services at once. One in four organizations report that their most significant certificate incident in the last year cost them more than $250,000. Set against that, the difference in price between certificate providers is a rounding error.

This is why the sticker price is not the total cost. Total cost of ownership includes the engineering time spent on emergency replacements, the support available when something goes wrong, the quality of the tooling that keeps certificates visible and renewable, and the risk that a provider's own troubles become yours. A provider that charges more but invests heavily in validation, security controls, audits, and round-the-clock support is selling something a bargain certificate cannot: assurance. Few organizations discover how much they value it until the night they need it. 

Local presence matters

When looking at a partner to help you develop the trust infrastructure for your organization, local presence should play an important part in your decision. Does your certificate provider have a true local presence that includes data centers in your geography, support services in your time zone, and technical operations close at hand?  

DigiCert has a global presence with data centers across the world and a substantial operational presence in Asia and particularly, in India. This includes engineering, cloud operations, and customer support. DigiCert ONE is deployed in data centers in India that host DigiCert Trust Lifecycle Manager and DigiCert Private CA, which helps customers meet data-residency and operational requirements. 

Learn from experience

History offers a lesson. When Chrome distrusted Entrust in 2024, customers were moved first to a partner and then, after Entrust sold its public certificate business in 2025, to a second provider. Each step was reasonable. Together they were disruptive, and they show why continuity matters. This is a lesson about transitions, not a prediction about any one company. No CA is immune to error; what counts is accountability, candor, and fixing the process that failed.

Moving forward with confidence

Moving to a new certificate provider is an opportunity to make certificate management simpler and more reliable. The maximum validity period of public TLS certificates fell to 200 days in March 2026. It will fall to 100 days in March 2027 and 47 days in March 2029. Clear ownership and automation can help teams manage this change with less manual effort.

Start with your immediate replacement needs, then identify improvements that will make future renewals easier. Look for a provider with the technical capabilities, responsive support, and long-term commitment to grow with your organization.

DigiCert and our authorized partners can help you evaluate your options and plan a transition that fits your environment. Contact DigiCert to discuss your certificate needs and take the next step with confidence.