eMudhra exits global TLS certificate business after weak intermediate keys

eMudhra to withdraw from global SSL/TLS

India-based certificate authority eMudhra said it is getting out of the global SSL/TLS business after issuing eight intermediate certificates with weak private keys. Chairman V. Srinivasan cited increasing costs and complexity of compliance requirements, along with the business generating about 1 percent of company revenue. He also said free TLS certificate providers reduced returns compared with other products and services.

In a Thursday post, the company said social media amplification around the incident brought scrutiny out of proportion to SSL/TLS's place in its business. Its board concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.

Weak intermediate certificates

The announcement came two days after researchers revealed the eight certificates. Their private keys were so defective that anyone could crack them in milliseconds and use them to mint TLS certificates trusted by major browsers, email servers, IoT devices, Docker containers, forgotten Linux machines and unmaintained command-line tools that ship their own copies of root certificates.

NIST P-384 elliptic curve private keys used in these certificates are supposed to contain roughly 384 bits of entropy. The compromised certificates had key sizes ranging from 3 to 8 bits. The eight defective private keys were 4, 56, 66, 115, 155, 156, 230 and 237. The strongest had a maximum of 256 possible keys, compared with 2 to the 384th power in a proper key.

Browser makers blocked certificates issued with the intermediate certificates within a day or two. eMudhra almost certainly faced the prospect of its certificate authority status being pulled by the CA/Browser Forum.

What eMudhra says went wrong

On Wednesday, eMudhra said the certificates were created under its ECC root in a Key Generation Ceremony held on April 30, 2025, using FIPS 140-2 Level 3 hardware security modules. A flaw in the ceremony caused a wrap and unwrap step to produce a second set of weak keys alongside the original strong keys. The weak keys were the ones published to browser root stores.

In a Mozilla Bugzilla thread, eMudhra said a flaw in the ceremony script created a second pair of weaker keys. Those weaker keys were used by mistake to create certificate signing requests because key labels were similar. Certificate signing requests from the weaker keys were also sent to fellow certificate authority Sectigo for cross signing. The company said certificate revocation lists were signed with the original private keys, producing incorrect signatures, and were then resigned with the flawed keys. It cited human errors in multiple steps and said it will reverify every key ceremony over the next week. A certificate revocation list is a digitally signed list published by a certificate authority identifying certificates revoked before their expiration dates.

Threat not fully gone

With intermediate certificates blocked by browsers, much of the threat is gone. But other devices that rely on the same certificates require much longer windows to take the same action, and embedded devices may never be able to block them.

Earlier coverage: რვა eMudhra-ს CA-ს პირადი გასაღები გატეხილია, ბრაუზერებმა სასწრაფო ბლოკირება ჩართეს

Sources: Ars Technica