eMudhra Limited, an India-based certificate authority, announced it would be withdrawing from the global TLS certificate business following a significant security incident involving the issuance of defective digital certificates. The company’s chairman attributed the decision to rising compliance costs, minimal revenue contribution from the SSL/TLS segment, and competition from free certificate providers. The chairman also noted that media attention surrounding the incident had created disproportionate scrutiny relative to the business unit’s overall importance.
The announcement came shortly after researchers disclosed that eMudhra had issued eight intermediate TLS certificates containing severely compromised private keys. The private keys, which should have contained approximately 384 bits of entropy according to NIST P-384 elliptic curve cryptography standards, instead ranged from 3 to 8 bits. The weakest keys had values as low as 4, making them trivial to discover and exploit. An attacker with minimal computational effort could crack these keys and generate fraudulent TLS certificates that would be accepted by all major web browsers and numerous email servers, IoT devices, and other systems relying on trusted certificate authorities.
eMudhra attributed the failure to flaws in a Key Generation Ceremony held on April 30, 2025, during which the certificates were created using FIPS 140-2 Level 3 Hardware Security Modules. The company identified multiple procedural errors in the key wrapping and unwrapping process, which resulted in a secondary set of weak keys being generated alongside the intended strong keys. The weak keys were mistakenly selected for certificate creation due to similar labeling. eMudhra acknowledged that human errors occurred at multiple stages of the key lifecycle management process and that certain quality control checks failed to catch the problem.
Browser manufacturers blocked certificates issued with the compromised intermediate credentials within days of discovery. The incident likely positioned eMudhra to face potential removal from the CA/Browser Forum, the industry body responsible for establishing standards and requirements for certificate authorities participating in the TLS ecosystem. While the blocking action by major browsers mitigated immediate risks, other systems and devices with longer update cycles or no update capability remained exposed to potential misuse of the compromised certificates.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI