eMudhra is leaving the certificate authority market after researchers found eight intermediate keys so weak that anyone could forge trusted web credentials instantly.
Key points
- eMudhra issued eight intermediate TLS certificates with private keys ranging from 3 to 8 bits, far below the required 384 bits.
- The company cited compliance costs, low revenue contribution, and social media scrutiny as reasons for exiting the TLS business.
- Browser makers blocked the compromised certificates within days of the discovery, preventing widespread misuse of the flawed credentials.
eMudhra announced it is withdrawing from the global SSL/TLS certificate business. The decision follows the disclosure of eight intermediate certificates containing critically weak encryption keys that allowed trivial forgery of trusted credentials.
What happened
Researchers revealed that eMudhra had issued eight intermediate TLS credentials with private keys so small they were easily discoverable. According to Ars Technica, the keys ranged from just 3 to 8 bits in size, whereas standard NIST P-384 elliptic curve keys require roughly 384 bits of entropy. This massive reduction in complexity meant an attacker could crack these keys in milliseconds.
Once cracked, these keys allowed anyone to generate TLS certificates for any website or mail server. These forged certificates would be trusted by major browsers and various devices, including email servers, IoT devices, and Docker containers. The specific private key values were identified as 4, 56, 66, 115, 155, 156, 230, and 237.
V. Srinivasan, chairman of eMudhra Limited, stated the company is exiting due to increasing compliance costs and complexities. He noted that the TLS business generated only 1 percent of the company’s revenue. Additionally, the rise of free certificate providers reduced returns on investment compared to other services.
The company also cited disproportionate social media scrutiny regarding the incident. In a post, eMudhra said the board concluded that withdrawing from global SSL/TLS was the right decision for shareholders. Browser makers blocked certificates issued with these intermediates within a day or two of the discovery.
Why it matters
Certificate authorities act as trusted verifiers of website identities. When an authority issues credentials with weak keys, it undermines the entire trust chain. Users rely on browsers to validate these certificates, assuming they are secure. If keys are easily guessed, attackers can impersonate legitimate sites without detection. This breaks the fundamental promise of encrypted connections, exposing users to interception and fraud.
The fix
Browser vendors have already blocked the specific compromised intermediate certificates. However, users should ensure their browsers and operating systems are updated to the latest versions. These updates typically include revocation lists that prevent trust in known bad certificates. No specific patch for eMudhra itself is needed, as the business is ceasing operations.
Why it matters
This incident highlights the critical importance of proper key generation and management in certificate authorities. Teams usually implement strict "ceremonies" to ensure cryptographic keys have sufficient entropy and are stored securely. When these processes fail, the resulting vulnerabilities can compromise the trust of millions of users globally. It serves as a reminder that the security of the entire web relies on the rigorous practices of a small number of trusted entities.
What to do and how to stay safe: eMudhra
- Update your web browser and operating system to ensure you have the latest certificate revocation lists.
- Verify that your organization’s servers are not using any intermediate certificates issued by eMudhra.
- Monitor security advisories for any new developments regarding the compromised keys or related trust issues.
- Educate your team on the importance of checking certificate validity and expiration dates regularly.
Step-by-step guide: What is password policies and how they protect systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What exactly was wrong with the eMudhra certificates?
The eight intermediate certificates had private keys with only 3 to 8 bits of entropy, instead of the required 384 bits, making them trivial to crack.
Can I still use eMudhra certificates?
No, eMudhra is exiting the TLS business, and browsers have already blocked the compromised certificates associated with this incident.
Did eMudhra face penalties for this breach?
The company cited compliance costs and social media scrutiny as reasons for leaving, but the source material does not mention specific financial penalties or legal actions.
