eMudhra exits global SSL/TLS business after weak intermediate CA keys
Original title: eMudhra Exits Global SSL/TLS Certificate Business Following the Vulnerability Disclosure
Mozilla and Google blocked eight weak intermediate keys on October 17; those CAs issued no end-entity certificates, while about 30,000 others need migration.
eMudhra’s board approved a voluntary exit from the global SSL/TLS certificate business after weak private keys were found in eight intermediate CA certificates. Researcher Wayne showed control of the keys on October 17, and Mozilla recovered them, confirming flawed generation from a lack of randomness. Google and Mozilla blocked the affected TLS keys that day and moved to distrust emSign ECC Root CA – G3. The company says infrastructure was not compromised. CERT-In reported no confirmed malicious exploitation as of October 21.
Unconfirmed: CERT-In said confirmed malicious exploitation was not established as of October 21, and eMudhra says its infrastructure was not compromised.
- CERT-In said the affected P-384 private keys had values smaller than 256.
- Six certificates supported TLS and two supported code signing.
- eMudhra revoked the affected CA certificates within 14 hours of discovery.
- Chrome’s root-store change was expected to reach devices on October 27.
- Global SSL/TLS is about 1% of revenue; G1 RSA roots stay during the transition.
Impact: Recovered keys could issue false certificates and impersonate websites
| Product | Affected |
|---|---|
| eMudhra intermediate CA certificates | eight intermediates; six TLS and two code signing |
| eMudhra emSign ECC Root CA – G3 | — |
- 1.Update browsers and trust stores, and review certificate chains.
- 2.Replace affected certificates, including bundles in apps, containers, and devices.
- 3.Do not assume a browser update covers every system that stores certificates.
- Vendors
- eMudhra
- Products
- emSign ECC Root CA – G3
From the original article
3 min read at cybersecuritynews.com
eMudhra Limited has announced it is exiting the global SSL/TLS certificate business after disclosing weak private keys in eight intermediate certificate authority certificates. The October 22, 2026, decision follows emergency browser protections and growing questions about the company’s certificate issuance controls. eMudhra said its other digital trust services remain unaffected.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.