eMudhra Exits Global Certificate Business
Indian firm eMudhra has announced its decision to withdraw from the global website authentication certificate business. This move comes after a significant security incident where eight of its intermediate SSL/TLS security certificates were discovered to have weak private keys, raising widespread concerns across the digital security landscape.
The company's board finalized the exit on October 22, following the incident's disclosure on October 17 by a researcher known as Wayne. Chairman V Srinivasan confirmed that all affected certificate authorities were revoked within 14 hours of the discovery. Despite the incident, eMudhra stated there was no breach of its infrastructure or data, and the compromised certificates had not been used to issue certificates to end-users or individual websites.
Understanding the Vulnerability
The core of the issue lay in the generation of the certificates on April 30, 2025. During a key-generation ceremony, the system inadvertently produced a set of weak private keys alongside strong ones. These weak keys were subsequently published to browser trust lists, creating a critical vulnerability.
Google later elaborated that the eight certificates were compromised due to insufficient randomness during private key generation, making them susceptible to guessing or recovery. This vulnerability, which remained undetected for approximately 18 months despite two independent audits, allowed for the potential impersonation of a certificate authority and the issuance of fraudulent HTTPS certificates. Major browsers including Google, Mozilla, and Apple swiftly blocked the affected certificates.
Customer Transition and Unaffected Services
eMudhra has committed to working with browser developers and its customers to facilitate a smooth transition. The company will replace affected customer certificates free of charge through its partners and will continue providing certificate status and revocation services until all existing certificates expire or are replaced.
The company's significant Indian operations, including digital signature certificates, eSign services, and other enterprise offerings, remain unaffected by this decision. This strategic exit from its global certificate business, which reportedly accounted for about 1% of eMudhra’s global revenue, underscores the company's response to the security incident and its focus on ensuring customer continuity for its primary services.