Indian certification authority eMudhra is shutting down its global SSL/TLS operations following the public exposure of critically weak private keys, including one with a value of just 4.
Key points
- eMudhra announced it is withdrawing from the global SSL/TLS certificate market.
- Security researchers found eight private keys with values ranging from 4 to 237.
- The company cited compliance costs and free competitors as additional reasons for exiting.
Indian certification authority eMudhra has decided to stop issuing global SSL/TLS certificates. This decision follows reports that the company used extremely weak private keys, one of which was simply the number 4.
What happened
eMudhra announced on Thursday that it was abandoning its global SSL/TLS certificate business. The company stated that this segment accounts for only about one percent of its global revenue. It argued that growing compliance costs and competition from free certificate providers made the business difficult to justify. The firm also claimed that social media scrutiny was out of proportion to the size of this business unit.
Security researchers had previously exposed eight affected private keys. These keys had values ranging from 4 to 237, including numbers like 56, 66, 115, 155, 156, and 230. The exposure occurred after a report was submitted to Mozilla on October 17. The company acknowledged that the incident brought intense public attention to its operations.
Why it matters
Private keys are secret mathematical values that prove a server’s identity. If these keys are weak or exposed, attackers can impersonate websites. This breaks the trust model of secure internet connections. Users may connect to fake sites without knowing it. Certification authorities must use strong, random keys to maintain security. Weak keys undermine the entire encryption infrastructure.
The fix
- Verify that your organization’s certificates are not issued by eMudhra.
- Check for any certificates that may have been compromised by weak keys.
- Plan to replace any affected certificates with those from trusted authorities.
- Monitor security advisories for updates on this specific incident.
Why it matters
Teams usually rely on certification authorities to validate website identities. When a CA uses weak keys, the trust chain is broken. Check whether your systems trust certificates from affected vendors. Review your certificate management processes to ensure strong key generation. Ensure that your security tools can detect compromised certificates. This helps maintain the integrity of your digital communications.
Background: Certificate management
Certificate management tracks digital IDs that prove server identity. You must automate renewal and validation to prevent trust errors. This process secures connections using public key cryptography without human intervention.
Read the full guide: Certificate Management Explained: How to Stop Digital Trust Failures
What to do and how to stay safe: eMudhra
- Audit your current certificates to see if any were issued by eMudhra.
- Contact your certificate provider to confirm the strength of their keys.
- Update your browser or system trust stores if they include affected CAs.
- Watch for official statements from eMudhra regarding certificate revocation.
Step-by-step guide: What is password policies and how they protect systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What was the weakest private key found in eMudhra's system?
The weakest private key found had a value of just the number 4.
When did eMudhra announce it was leaving the SSL/TLS business?
The company announced the decision on Thursday, following the key exposure reports.
How many private keys were affected by this weakness?
Eight private keys were affected, with values ranging from 4 to 237.
