eMudhra Limited announced it is withdrawing from the global SSL/TLS certificate business following a major security incident in which the company issued eight intermediate certificates containing severely compromised private keys.
The certificates, issued during a key generation ceremony on April 30, 2025, contained private keys with entropy levels between 3 and 8 bits, compared to the standard 384 bits required for NIST P-384 elliptic curve cryptography. This deficiency meant that the strongest of these keys had only 256 possible combinations, making them trivial to crack within milliseconds. The weak keys allowed anyone who obtained them to generate TLS certificates that would be trusted by major web browsers, email servers, IoT devices, and various other systems relying on the compromised root certificates.
eMudhra attributed the failure to a flaw in the key generation ceremony script used that specific day. The company’s investigation revealed that a deviation from standard procedures to test a wrap and unwrap process resulted in the creation of a second set of weak keys. Due to similar key labels, the weaker keys were mistakenly used to generate certificate signing requests instead of the original strong keys. The company acknowledged multiple human errors across multiple steps of the process and indicated it would reverify every key ceremony previously conducted.
Chairman V. Srinivasan cited rising compliance costs, low revenue contribution at one percent of total business, and competition from free certificate providers as factors in the decision. However, the company also noted that the substantial social media attention surrounding the incident and resulting scrutiny played a significant role in the board’s choice to exit the market. Browser manufacturers blocked certificates issued with the compromised intermediates within days of discovery, mitigating immediate threats, though embedded and legacy devices may lack the capability to implement similar blocks.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI