Indian tech company eMudhra announces withdrawal from certificate business after security incident
Indian certificate authority eMudhra announced it will withdraw from the global SSL/TLS certificate business after discovering weak private keys in eight of its intermediate certificates.
The company, one of only Indian root certificate authorities trusted by major web browsers, said it was voluntarily withdrawing from the certificate business after the weak keys were discovered. According to Google, Mozilla and several other companies, the keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control.
Cloudflare explained that the certificates were widely trusted by browsers and operating systems. Because of the weak keys, any attacker could create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic.
Weak Keys Discovery
The issue was publicized by cybersecurity researcher Scott Helme, who published a blog revealing that instead of a random 384-bit number, one of the private keys was just the number four. Others were simply 56 and 115.
eMudhra said the certificates were created during a ceremony in April 2025 and that "the problem was a flaw in one step of the ceremony procedure." The issue went undetected for 18 months and survived two independent audits before a researcher reverse engineered the weak keys.
Company Response
eMudhra's chairman, V. Srinivasan, said on Thursday that the company revoked the affected certificates within 14 hours of their discovery and claimed there were no compromises or data breaches as a result of the issue. India's Ministry of Electronics and IT said it is investigating the incident but defended the company, arguing that "some social media accounts are indulging in fear mongering about the impact of this incident."
Revocation and certificate status services will keep running until every issued certificate has expired or been replaced. eMudhra will complete its remaining commitments to the browser root programs, including a full root-cause report.
Business Impact
In announcing its withdrawal from the certificate business, Srinivasan said it only accounted for 1% of the company's revenue but became increasingly costly due to compliance requirements and "complexity." He blamed "social media amplification" for the increased scrutiny around the company.
CERT-IN warned that an attacker able to exploit the compromised private keys could "potentially impersonate legitimate websites or intercept or modify data exchanged between users and servers, potentially facilitating credential theft, sensitive data exposure and financial fraud."
Brian Fox, co-founder of cybersecurity firm Sonatype, told Recorded Future News that the issue goes far beyond browsers because certificate trust stores are embedded in dozens of products. "That makes this a software supply chain problem, not just a certificate revocation event," he said, noting that the fixes started shipping within days, but finding and adopting them is now the challenge.
Related
