eMudhra exits certificate business after weak intermediate keys
Original title: Indian tech company eMudhra announces withdrawal from certificate business after security incident
Eight intermediate keys were trivial values; browsers blocked them, and the firm says nothing was breached.
Indian root certificate authority eMudhra said it is voluntarily leaving the global SSL/TLS certificate business after eight intermediate private keys were found to be weak. Researcher Scott Helme reported that instead of random 384-bit values, keys were the numbers 4, 56 and 115. Firefox, Apple and Chrome blocked the certificates because forged HTTPS certificates could impersonate sites and intercept or modify traffic. eMudhra said an April 2025 ceremony flaw went undetected for 18 months, certificates were revoked within 14 hours, and it will keep revocation services running while customers migrate.
Unconfirmed: eMudhra says there was no compromise or data breach; India's IT ministry says it is still investigating.
- The chairman said the certificate business was about 1% of revenue.
- Affected intermediates were not due to expire until April 2040.
- CERT-IN warned of impersonation, credential theft and falsely signed software.
- Google said it is still reviewing eMudhra's remaining Chrome Root Store certificates.
- The company promised a full root-cause report to browser root programs.
Impact: forged HTTPS certificates that can intercept or modify traffic
| Product | Affected |
|---|---|
| eMudhra intermediate SSL/TLS certificates | eight intermediates from an April 2025 ceremony |
- 1.Migrate customers off the affected eMudhra root.
- 2.Update clients and bundles that do not process revocation information.
From the original article
3 min read at therecord.mediaThe issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.