TORONTO, November 5, 2026 — The deadline problem facing organisations that relied on eMudhra's public certificate services has moved from distrust dates to expiry dates. New research from ProteQC, a vendor-neutral post-quantum cryptography advisory firm, shows that virtually all of the eMudhra certificates still in circulation expire within about 100 days, while the process of approving and onboarding a replacement supplier can take six months or longer for regulated enterprises.

ProteQC released the research on November 3, 2026, following eMudhra's disclosure of weak cryptographic signing keys in several of its certificate authorities and its withdrawal from the global public certificate authority market. Using publicly available Certificate Transparency logs, domain data, and trust-store records, ProteQC identified at least 2,629 registrable domains across approximately 500 organisations that held unexpired eMudhra-issued server certificates at the time of disclosure on October 17, 2026.

The timing is the problem. Virtually all of the identified certificates, 99.97 percent, expire on or before January 25, 2027, within 100 days of the October 17 disclosure, based on ProteQC's analysis of public Certificate Transparency records. Only five expire later. In ProteQC's experience, a typical supplier onboarding timeline for regulated organisations that must complete third-party risk assessments and compliance reviews is six months or longer.

As of November 2, 2026, approximately 80 percent of the identified certificates remained unexpired. Of the organisations that had so far obtained a replacement, around three-quarters re-issued with eMudhra's newer certificate generation and around one-quarter moved to other providers. But 340 domains whose eMudhra certificates have already expired show no replacement certificate in public Certificate Transparency logs, a potential loss of certificate continuity that grows as further certificates reach expiry.

"The lesson here goes far beyond one certificate provider," said Tim D. Williams, CTO and co-founder of ProteQC. "Organisations need to be able to replace a cryptographic supplier within a defined timeframe, not discover during a crisis that their internal processes take longer than their certificates have left to run. That same capability will be essential as businesses prepare for the transition to post-quantum cryptography."

Securetron says the gap is a migration and inventory problem, not only a revocation problem. Certificates that were never distrusted still expire, and the organisations at risk are the ones that cannot say, today, how many certificates they hold, who issued each one, when each expires, and whether a replacement is already in place, across every trust store and deployment, not just in the browser.

"Every migration starts with the same question: what do we actually have?" said Sarah Reid, Securetron. "If you cannot list every certificate, its issuer, its expiry, and its replacement status, you cannot plan a 100-day migration, and you certainly cannot prove to a regulator that you did. Discovery has to come before re-issuance."

PKI Trust Manager, Securetron's certificate lifecycle management platform, continuously discovers certificates, expiring assets, and vulnerabilities across the enterprise, with no blind spots and no spreadsheets. It automates issuance, renewal, and monitoring for the entire certificate lifecycle, alerts on expiring certificates with configurable lead times and routing, and provides a single pane of glass across ADCS, MSCA, Let's Encrypt, DigiCert, ACME, and more, with full audit trails for every action. Its built-in RFC 8555 ACME server with EAB, plus SCEP and EST, lets certbot, acme.sh, win-acme, and network devices enrol automatically.

Boltron-AI, Securetron's AI module for PKI Trust Manager, discovers certificates, applications, and PKI assets, profiles their configurations, and generates step-by-step onboarding runbooks for each application, then validates the outcome and continues monitoring. PKI Trust Manager's Community Edition is free for up to 500 certificates, on-premises or as a service through PKI Trust Cloud.

ProteQC notes its findings are based exclusively on publicly available information, reflect publicly recorded certificate issuance rather than live deployment, and do not indicate that every identified domain is currently using an affected certificate or experiencing a security issue.

About Securetron:
Securetron builds PKI Trust Manager, an enterprise certificate lifecycle management platform that discovers, provisions, renews, and revokes certificates across the enterprise, with AI-driven onboarding through Boltron-AI. Securetron also builds AI-FW, a self-hosted AI firewall and governance gateway between AI agents and LLM backends. Learn more at https://securetron.net.

Press Contact:
Sarah Reid, Securetron
1 Yonge St, Toronto, ON M5E 1E6, Canada
+1 (438) 927-8036
[email protected]
https://securetron.net