cyber.hendryadrian.com
Security News · cyberscoop.com

eMudhra to Exit SSL/TLS Certificate Business After Weak Keys Found in Eight Certificates

· Original article ↗

Summary

eMudhra will stop issuing SSL/TLS certificates after researchers recovered the weak private keys of eight intermediate certificates. Browsers and software projects blocked or removed trust, while CERT-In reported no observed malicious use.

Key points

  • Researcher Scott Helme recovered the private keys for eight eMudhra intermediate certificates in under a second; each key was an integer below 256.
  • eMudhra attributed the weak keys to an error during an April 2025 key-generation ceremony and said the unintended keys reached browser trust lists.
  • The company said its infrastructure was not compromised, no data was breached, and none of the eight intermediates had issued end-entity certificates; whether the keys were used is unknown.
  • Chrome, Firefox, Apple, Microsoft, Go, Node.js, Python’s certifi bundle, and several Linux distributions blocked or updated trust for the certificates.
  • Mozilla removed eMudhra’s root certificate from its trusted list; Google said it planned to remove that root in a forthcoming Chrome update while reviewing another eMudhra root.
  • CERT-In said it had seen no malicious use of the keys as of Wednesday.

Article Details

Event Type
eMudhra is exiting its SSL/TLS certificate business after researchers showed that eight intermediate certificates had weak private keys that could be reconstructed rapidly.
Impact
Major browsers blocked the affected certificates, and eMudhra's root certificate was removed or slated for removal from browser trust lists. The company said no end-entity certificates were issued by the affected intermediates, its infrastructure was not compromised, and no data was breached; CERT-In reported no observed malicious use as of Wednesday. The company acknowledged unquantified reputational risk, and its shares fell 40% in the two days after disclosure.

People

Scott HelmeSecurity researcher who recovered all eight weak eMudhra intermediate-certificate private keys in less than a second.V. SrinivasaneMudhra chairman who discussed the board's decision to leave the certificate business.

Vendors

eMudhraIndian certificate authority eMudhra said Thursday it will stop issuing SSL/TLS certificates days after researchers showed that the private keys securing eight of its certificates were so weak they could be

Industries

Certificate authorityIndian certificate authority eMudhra said Thursday it will stop issuing SSL/TLS certificates days after researchers showed that the private keys securing eight of its certificates were so weak they could beEnterprise securityThe company said its other businesses, including digital signature and enterprise security services, continue to operate normally, and acknowledged reputational risks it cannot quantify.