eMudhra Limited announced its withdrawal from the global SSL/TLS certificate business following the discovery of a significant security flaw in its key generation process. The India-based certificate authority had issued eight intermediate TLS certificates containing private keys so weak that they could be cracked in milliseconds, allowing attackers to generate fraudulent certificates trusted by major browsers and numerous other systems.
The defective keys violated cryptographic standards by containing only 3 to 8 bits of entropy instead of the required 384 bits for NIST P-384 elliptic curve cryptography. The private keys themselves were the numbers 4, 56, 66, 115, 155, 156, 230, and 237. This weakness meant that instead of the intended 2384 possible key combinations, the strongest of these keys had a maximum of just 256 possibilities. Browser manufacturers blocked the compromised certificates within one to two days of discovery, mitigating immediate threats.
eMudhra attributed the problem to a flaw in its Key Generation Ceremony conducted on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules. The company explained that an error in the ceremony’s script caused a wrap/unwrap procedure—used to transfer keys between devices—to generate a second set of weak keys alongside the intended strong keys. By mistake, the weak keys were used to create certificate signing requests and were subsequently published to browser root stores. Human errors occurred at multiple steps, including a failure to investigate why initial certificate revocation list signatures were incorrect.
In his statement, eMudhra’s chairman V. Srinivasan cited rising compliance costs, modest revenue contribution at 1 percent of total earnings, and increased competition from free certificate providers as reasons for exiting the market. However, he also noted that the incident’s amplification on social media generated disproportionate scrutiny. The company faced the likelihood of losing its certificate authority status through the CA/Browser Forum, which sets industry standards for TLS programs.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI