Key points
- eMudhra announced it is withdrawing from the global SSL/TLS certificate issuance business following the exposure of weak private keys.
- Security researchers found eight affected private keys, with values ranging from the single digit 4 to the number 237.
- The company cited disproportionate social media scrutiny and rising compliance costs as reasons for exiting a business unit that generates only 1 percent of global revenue.
Indian certificate authority eMudhra has decided to stop issuing global SSL/TLS certificates after security researchers discovered that one of its private cryptographic keys was merely the number 4. The company announced Thursday that it is abandoning this arm of its business entirely, citing both the intense public scrutiny and economic factors that make the segment no longer viable for its shareholders.
How it unfolded
- On October 17, a report was sent to Mozilla regarding eMudhra’s weak private keys.
- Two days later, public reports exposed the vulnerability, revealing that eight private-key values were exceptionally low, including 4, 56, and 66.
- On Thursday, eMudhra announced its decision to withdraw from the global SSL/TLS market, stating the board concluded this was the right strategic move after detailed deliberations.
Who is affected
The disclosure impacted the broader trust infrastructure for internet security, as eMudhra is a recognized certification authority. The company stated that global SSL/TLS issuance accounts for about 1 percent of its global revenue, meaning the financial impact on the wider organization is limited. However, the incident drew significant attention from security researchers and the public, leading to what eMudhra described as scrutiny out of proportion to the business unit’s size.
What happens next
eMudhra will cease operations in the global SSL/TLS certificate space. The firm argued that growing compliance costs and competition from free certificate providers had already made the business difficult to justify before the recent breach. The board determined that exiting this sector protects shareholder interests, removing a small but high-risk component of their portfolio amid increased data sovereignty requirements and market pressure.
The background in plain language
Certificate authorities act as trusted intermediaries that verify the identity of websites. They issue digital certificates that enable secure, encrypted connections between browsers and servers. This trust relies on the authority keeping its private keys secret. If a private key is weak or exposed, attackers can impersonate any website the authority has certified, undermining the security of the entire chain. Teams usually monitor certificate transparency logs to detect anomalies.
What to do and how to stay safe: eMudhra
- Review your internal certificate inventory to identify any certificates issued by eMudhra and assess their current status.
- Monitor certificate transparency logs for unusual issuance patterns from known authorities to detect potential key compromises early.
- Ensure your systems validate certificate chains strictly, rejecting any certificates that do not meet current cryptographic strength standards.
- Once the vendor provides an update or further guidance, follow their instructions for revoking or replacing affected certificates.
Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What values were the compromised private keys?
The eight affected private keys had values ranging from 4 to 237, including 4, 56, 66, 115, 155, 156, 230, and 237.
Why is eMudhra leaving the SSL/TLS business?
The company cited disproportionate social media scrutiny, growing compliance costs, and competition from free providers as reasons for exiting.
How much of eMudhra's revenue comes from SSL/TLS?
Global SSL/TLS issuance contributes to about 1 percent of eMudhra’s global revenue.
