eMudhra Limited, an India-based certificate authority, announced it will withdraw from the global SSL/TLS business effective immediately. The decision came two days after security researchers disclosed that the company had issued eight intermediate TLS certificates containing severely compromised private keys.
The defective certificates used elliptic curve cryptography with private keys ranging from just 3 to 8 bits of entropy, compared to the standard 384 bits that such keys should contain. The actual private keys published in the certificates were the numbers 4, 56, 66, 115, 155, 156, 230, and 237. This weakness meant that anyone with basic computational resources could discover the private keys in milliseconds and then mint fraudulent TLS certificates that would be trusted by all major web browsers and numerous other systems relying on the certificate chain.
Chairman V. Srinivasan cited mounting compliance costs and complexities, combined with TLS representing only 1 percent of company revenue, as business rationale for the exit. He also noted that the proliferation of free certificate services from competing organizations had eroded profit margins. However, the company acknowledged that negative attention on social media regarding the security incident played a significant role in the board’s decision to withdraw from the sector.
eMudhra subsequently provided technical details explaining the breach resulted from errors during a key generation ceremony held on April 30, 2025. The company stated that a flaw in the ceremony’s script caused a wrap/unwrap procedure to generate a second set of weak keys alongside properly generated keys. Personnel then mistakenly used the weaker keys to create certificate signing requests due to similar key labeling, leading to their publication to browser root stores.
The company identified multiple human errors and process failures in the key lifecycle management. Browser manufacturers blocked the compromised certificates within one to two days of discovery. eMudhra faced likely revocation of its certificate authority status by the CA/Browser Forum, the industry group governing TLS certificate programs. The firm stated it would conduct a comprehensive review of all previous key ceremonies.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI