eMudhra exits global SSL/TLS issuance after weak CA private keys
Original title: Disgraced Indian cert issuer leaves the cert issuing business
Eight intermediate CA keys were tiny integers, including 4; the firm says none issued end-entity certificates.
Indian certification authority eMudhra said it is leaving the global SSL/TLS certificate business after public reports showed weak private keys on eight intermediate certificate authorities. Reported key values were 4, 56, 66, 115, 155, 156, 230, and 237. The company said a wrap/unwrap flaw in its key-generation ceremony published those weak keys to browser root stores alongside intended strong keys, that it revoked the CAs within 14 hours, and that they had issued no end-entity certificates. It will keep revocation services running, serve G1 RSA roots during a free customer transition, and still issue a root-cause report.
Unconfirmed: eMudhra's claims that no end-entity certificates were issued and that no systems or data were compromised are the company's own statements.
- The issue was reported to Mozilla on October 17 and public reports followed two days before the exit announcement.
- eMudhra says global SSL/TLS is about 1 percent of global revenue.
- The firm says the infrastructure had two years of independent audits and was in browser trust lists since mid-2025.
- It claims neither infrastructure nor data was compromised.
Impact: Weak intermediate CA keys could allow forged trusted certificates
| Product | Affected |
|---|---|
| eMudhra intermediate certificate authorities | eight intermediate CAs |
- 1.Treat the eight affected intermediate CAs as revoked and confirm they are blocked in trust stores.
- 2.Plan replacement of remaining eMudhra G1 RSA certificates as customers are transitioned.
From the original article
3 min read at theregister.comWe didn't want to issue SSL/TLS certs anyway, Indian firm suggests after one private key turns out to be the number 4
By Brandon Vigliarolo · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.