eMudhra Exits the Global SSL/TLS Certificate Market
The prominent Indian digital trust services company eMudhra officially announced on October 22 its immediate withdrawal from the global SSL/TLS certificate business. This significant decision follows a critical security revelation.
Recent reports exposed severe cryptographic key flaws affecting eight intermediate certificates issued by the company. Shockingly, one specific certificate possessed a private key consisting of the solitary digit “4.” Consequently, malicious actors could effortlessly crack the encryption and forge fraudulent certificates in mere moments. In response, major technology platforms, including Google, Apple, Microsoft, and Mozilla, swiftly revoked their trust in the compromised certificates.
Financial Realities and Strategic Shift
Chairman V. Srinivasan addressed the situation in a corporate statement. He clarified that the global SSL/TLS sector contributed approximately 1% to the firm’s total revenue. The operational expenses and logistical complexities associated with this division have escalated steadily. Furthermore, the proliferation of large institutions dispensing free SSL/TLS certificates severely diminished the potential return on investment. After careful deliberation, the board of directors elected to voluntarily abandon the global SSL/TLS market. Moving forward, they will concentrate corporate resources entirely on other enterprise solutions and specialized digital trust services.
The Discovery of the Cryptographic Vulnerability
According to comprehensive incident logs published by Mozilla, diligent researchers reported the compromised private keys on October 17. If attackers obtained these vulnerable keys, they could manipulate the associated trust chains. This manipulation allows for the creation of deceptive website certificates that browsers blindly accept. Consequently, hackers could effectively impersonate legitimate websites. This severe risk extends beyond web browsers; it potentially jeopardizes mail servers, IoT devices, and various software applications relying on identical certificate trust architectures.
Unmasking the Weak Keys
Security researchers publicly disclosed the astonishingly weak numerical values of the eight private keys: 4, 56, 66, 115, 155, 156, 230, and 237. These keys corresponded to the NIST P-384 elliptic curve. Under normal circumstances, a private key of this type should boast a robust security strength of roughly 384 bits. However, the discovered keys all possessed values under 256. This drastically limited the actual search space to a maximum of 256 possibilities, rendering them exceptionally vulnerable to rapid recovery.
eMudhra Explains the Catastrophic Failure
On October 21, eMudhra issued an official explanation regarding the crisis. They traced the root of the problem back to a specific key generation event that occurred on April 30, 2025. The company utilized a Hardware Security Module (HSM) compliant with stringent FIPS 140-2 Level 3 standards. Unfortunately, a fatal flaw within the key wrapping and unwrapping procedures inadvertently generated an additional set of exceptionally weak keys. Ultimately, technicians mistakenly applied these compromised keys to the intermediate certificates.
In subsequent discussions on Mozilla’s Bugzilla platform, the company elaborated on the procedural failure. The established workflow had temporarily deviated from standard protocols to facilitate testing of the wrapping mechanisms. A software defect triggered the generation of the secondary, weaker key set. Because the key labels appeared deceptively similar, personnel erroneously selected them to generate Certificate Signing Requests (CSRs). These requests were subsequently signed by the company’s root certificate. Furthermore, they submitted some of the compromised certificates to Sectigo, another Certificate Authority, for cross-signing.
Ongoing Investigations and Corrective Measures
eMudhra acknowledged that the incident involved multiple human errors throughout the key lifecycle management process. The company is currently conducting a rigorous investigation into the specific code defects, procedural vulnerabilities, and operational review mechanisms. Additionally, they plan to comprehensively re-examine all prior key generation ceremonies to ensure systemic integrity.
The firm definitively stated that their underlying infrastructure remained uncompromised. They confirmed that no data breach occurred during this incident. Furthermore, the event has not impacted their domestic Digital Signature Certificate (DSC) and electronic signature (eSign) operations within India.
Simultaneously, the company pledged to continue collaborating with browser root certificate programs and affected clients. This cooperation aims to facilitate a smooth and secure business transition. The existing G1 RSA root certificates will maintain service for clients until the transition concludes completely. The firm will also leverage its network of partners to provide complimentary replacement certificates. They commit to operating certificate revocation and status inquiry services until all previously issued certificates either expire naturally or receive proper replacements.
While mainstream browsers have swiftly blocked the compromised certificates, lingering threats remain. Certain devices with extended update cycles, specific embedded systems, and distinct software utilizing independent certificate trust stores may require significantly more time to achieve full remediation. Concurrently, Mozilla announced proactive measures to update its dedicated certificate trust store. They will deliberately remove the specific root certificate responsible for issuing the vulnerable intermediate certificates. This decisive action will further protect the numerous applications that rely upon the Mozilla trust store and its various derivatives.
