eMudhra ends certificate business after weak private keys cracked
Original title: eMudhra kills its certificate business after researchers cracked its private keys in under a second
Eight intermediate keys were integers below 256, one of them 4; major browsers blocked the certificates within days.
Indian certificate authority eMudhra said Thursday it will stop issuing SSL/TLS certificates after researchers showed private keys for eight intermediate certificates could be reconstructed in under a second. Scott Helme recovered all eight on a laptop; the company blamed an April 2025 key ceremony that published a weak key set and said none of those intermediates issued end-entity certificates. Chrome, Firefox, Apple and Microsoft blocked the certificates, Mozilla removed the root, and Google plans to drop it from Chrome next week. CERT-In reported no malicious use as of Wednesday, while other eMudhra businesses continue.
Unconfirmed: Whether anyone used the weak keys is not known; eMudhra says no breach occurred.
- Each of the eight keys was a whole number below 256.
- The company said its infrastructure was not compromised and no data was breached.
- Shares fell 40% in the two days after disclosure.
- Go, Node.js, Python’s certifi bundle and several Linux distributions shipped updates.
- The chairman cited compliance costs, free certificates from large providers and social-media scrutiny.
Impact: Weak keys could forge certificates and impersonate websites
| Product | Affected |
|---|---|
| eMudhra SSL/TLS intermediate certificates | eight intermediates from an April 2025 ceremony |
- 1.Apply browser, language-runtime and Linux updates that block or remove the eMudhra root.
From the original article
3 min read at cyberscoop.com
The private keys were so weak they could be guessed in under a second — and one of them was just the number 4. The post eMudhra kills its certificate business after researchers cracked its private keys in under a second appeared first on CyberScoop.
By Greg Otto · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.