eMudhra, a Certificate Authority (CA), has announced its decision to completely withdraw from the global SSL/TLS certificate market. This decision comes just days after security researchers uncovered a critical vulnerability in eight subordinate certificates issued by the company, where the private cryptographic keys were astonishingly weak, making them susceptible to compromise in fractions of a second.
Details of the Security Vulnerability
According to technical reports, the Elliptic Curve Cryptography (ECC) keys issued by the company should have had a high level of complexity (384 bits), but the discovered keys ranged in strength from only 3 to 8 bits. This means that the number of possible key combinations was extremely small, allowing any party to generate trusted web certificates for any website or mail server, which poses a severe security threat to the internet infrastructure.
Why This News Matters
The gravity of this incident lies in the fact that certificates issued by eMudhra were trusted by major browsers and operating systems. Once the vulnerability was discovered, browser vendors were forced to immediately revoke and block these certificates. However, Internet of Things (IoT) devices, Docker containers, and legacy systems that do not receive regular updates remain vulnerable for extended periods, as they may fail to update their trusted certificate stores.
Human and Technical Errors in the "Key Generation Ceremony"
eMudhra explained that the flaw occurred during a "Key Generation Ceremony" in April 2025. The company pointed out that a bug in the software used led to the creation of two sets of keys: one strong and one weak. Due to human error in labeling, the weak keys were used to issue certificates and publish them to root stores. The company also admitted that it attempted to re-sign Certificate Revocation Lists (CRLs) using the flawed keys after failing to sign them with the original keys, without initiating a root-cause investigation into the failure.
Motives for Withdrawal
The company's chairman, V. Srinivasan, justified the withdrawal decision by citing the high costs of regulatory compliance, low return on investment due to the prevalence of free certificates, as well as the media pressure and intense scrutiny following the incident, which the company described as "disproportionate" to the scale of this activity within its business portfolio.