eMudhra Limited, an India-based certificate authority, announced it will withdraw from the global SSL/TLS certificate business following a significant security incident involving defective private keys.
The company disclosed that it had issued eight intermediate TLS certificates with private encryption keys so weak they could be cracked in milliseconds. The compromised keys had entropy levels ranging from 3 to 8 bits, far below the 384 bits required for NIST P-384 elliptic curve cryptography certificates. The defective private keys were measured as 4, 56, 66, 115, 155, 156, 230, and 237, compared to the intended 2384 possible variations. This vulnerability would have allowed anyone possessing these keys to generate fraudulent TLS certificates trusted by all major browsers, email servers, IoT devices, and other systems relying on standard certificate authorities.
eMudhra attributed the problem to procedural errors during a Key Generation Ceremony held on April 30, 2025. The company explained that a flaw in the ceremony’s script caused a wrap/unwrap step—used to transfer keys between hardware security modules—to produce a second set of weak keys alongside properly generated keys. The weaker keys were mistakenly selected for certificate signing requests due to similar labeling, and these defective certificates were subsequently signed and distributed to browser root stores. Additionally, initial certificate revocation lists were signed with incorrect signatures, raising questions about eMudhra’s quality control processes.
Browser manufacturers blocked the compromised certificates within days of discovery. eMudhra faced the prospect of losing its certificate authority status from the CA/Browser Forum, the industry body governing TLS programs. The company cited increasing compliance costs, minimal revenue contribution from the TLS business, and competition from free certificate providers as reasons for the withdrawal. eMudhra’s chairman noted that media attention to the incident was disproportionate to the business’s actual importance within the organization.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI