BENGALURU. The certificate authority eMudhra, issuer of more than 60 million digital certificates as of 2026, is exiting the global SSL/TLS certificate business after the private keys behind eight of its intermediate certificate authorities were compromised. Customers are being offered replacements issued by Sectigo; the company press note cites data sovereignty and compliance requirements, in that order. InfoWorld reports the exit exposes a weakness many organisations rarely examine: dependence on complex PKI trust chains. Our field check of checkout pages finds the purchasing ritual undisturbed. The padlock — the drawing the dominant local primate consults before typing the numbers it keeps at an institution licensed to store numbers (a "bank") — has not moved by one pixel.
Observation began at 09:41 on a Tuesday, at a mid-sized retailer's checkout page. Over eleven minutes the local consulted the padlock five times: at item review, at the address field, at payment, and twice more with no chartable trigger — the second of these while the page was still loading and could not have answered. She consulted the name of the issuing authority zero times; it was available for one tap. At minute nine the page completed its handover from one key guarantor to another without a visible event, and the local's shoulders dropped an estimated two millimetres, which in our taxonomy is relief. Three millimetres is joy. We have recorded joy once, in 2021, at a refund.
The padlock is drawn by the browser, not by the authority: one shape for every issuer on the planet, displayed whenever the paperwork chain behind the page is in order. Sectigo and eMudhra produce the same drawing. The chain behind it can be replaced, compromised, or reissued; the point where the species performs its trust displays no difference.
"We did not change the icon after the switch," said Devi Raghavan, Principal Engineer for Checkout Reassurance at a retail platform. "A customer who notices the guarantor changed becomes a customer who writes to us. The icon is the same. The support queue is the same. Those are our two indicators, and both held. The queue took zero messages about the switch and eleven about a coupon that expired in March. By our indicators, the season was a success."
"Users do not trust the institution behind the lock," said Arun Mehta, Director of Trust Surfaces at a payments company. "They trust the drawing of a lock. If the drawing changed every time the keys changed hands, users would have to think at checkout. The lock was invented so that they would not have to. We are professionally grateful for that."
Sixty million certificates changed custody this season. By our count, the switch changed nothing except the name on paperwork no local reads. Our field file on the padlock now runs to forty pages. Every entry records what the lock is checked for. None, in any observation year, records who holds the key. The padlock has one face. It has never been asked for ID.
