THE CRUNCH
Indian certificate authority eMudhra is pulling out of the global SSL/TLS certificate business entirely, days after security researchers exposed that the private keys of eight of its intermediate certificates were trivially weak. One key was literally the number 4; others were 56, 66, 115, 155, 156, 230 and 237. Because the keys belonged to intermediate certificate authorities trusted by major browsers and operating systems, an attacker who intercepted a connection could have forged HTTPS certificates for any domain and impersonated websites to read or modify traffic. Browsers including Firefox, Chrome and Apple's platforms moved to block the certificates.
eMudhra attributed the failure to a flaw in a key-generation ceremony held in April 2025, saying a wrap/unwrap step produced a second set of weak keys alongside the intended strong ones, and that the weak keys were the ones published to browser root stores. The problem went undetected for 18 months and survived two independent audits before a researcher reverse engineered the keys. The company says it revoked the affected intermediates within 14 hours of discovery, that they had issued no end-entity certificates, and that neither its infrastructure nor its data was compromised.
Chairman V. Srinivasan announced the withdrawal on Thursday, saying global SSL/TLS contributes only about 1 percent of the company's revenue, that free certificate providers and rising compliance costs had eroded the business case, and that social media amplification had brought scrutiny out of proportion to the unit's size. India's Ministry of Electronics and IT is investigating the incident but has defended the company, while CERT-IN warned that the weak keys could have enabled website impersonation, credential theft and fraudulent software signatures.
The wind-down will be gradual. eMudhra says it will keep serving its G1 RSA roots and transition customers to other certificate issuers free of charge, complete its remaining browser root programme commitments including a root-cause report, and keep revocation and certificate status services running until every issued certificate has expired or been replaced. Google, meanwhile, says it is closely investigating whether eMudhra's remaining CA certificates should stay in the Chrome Root Store.