The Web's Hidden Plumbing Is Leaking

eMudhra, an Indian certificate authority, announced this week that it is exiting the global SSL/TLS certificate business — a move that generated 696 comments on Hacker News and unsettled the web security community for reasons that go well beyond a single company's product decision. The entire system behind the padlock in a browser depends on a hierarchy of trusted certificate authorities whose names ship baked into every major browser. eMudhra's carefully choreographed departure requires ongoing coordination with browser vendors, revocation of outstanding certificates on a schedule, and maintenance of OCSP responders; a mismanaged exit, commenters warned, could open a window of validation failures for relying parties.

The concentration risk argument dominated the security discussion: every CA exit pushes more market share toward an already narrow center. IdenTrust, DigiCert, Sectigo, and Let's Encrypt collectively issue the overwhelming majority of certificates today, and eMudhra's departure tightens that grip further. The authority was particularly prominent in Indian government PKI infrastructure and among enterprises across South and Southeast Asia with regional compliance requirements — customers who now face non-trivial migrations, especially where applications use certificate pinning or hardcoded trust chains. For much of the HN security community, the announcement felt less like a shock than a resolution of accumulated tension: eMudhra had faced documented compliance incidents in the Mozilla bug tracker in recent years.

Simultaneously, Quad9 — a nonprofit DNS resolver used by tens of millions of people for privacy-respecting, malware-blocking query resolution — published a post titled 'Au Revoir France,' announcing its withdrawal from the country. A French court, responding to action by the French football federation, had ordered Quad9 to block specific domains associated with piracy. Quad9 concluded that operating under France's legal environment was incompatible with its mission. The 415-point submission drew 415 comments that functioned as a referendum on internet governance in the EU, pitting those who argue DNS resolvers used for circumvention are appropriately subject to content regulation against those who argue holding infrastructure providers liable for user behavior inverts the internet's foundational design. DNS, BGP, and TCP/IP were explicitly built to be content-neutral at the protocol layer; requiring them to be content-aware on demand from national courts asks those providers to implement functionality the protocol designers deliberately omitted.

Taken together, the eMudhra and Quad9 stories illuminate the same underlying dynamic: the systems that tell a browser a website is safe, or that route a DNS query to the right address, are maintained by organizations operating under real-world regulatory and financial pressures. When those pressures become intolerable, the organizations exit — and the effects ripple outward in ways that are genuinely difficult to trace.