--- title: "eMudhra exits TLS certificate business following weak key incident" publisher: "Stockmark.IT" author: "Stockmark.IT Website" published: "2026-10-23T07:48:40+00:00" modified: "2026-10-23T07:48:40+00:00" date: 2026-10-23 canonical: "https://stockmark.it/disgraced-emudhra-drops-out-of-tls-business-after-using-cert-private-k/" category: "Business" categories: ["Business", "global markets"] image: "https://i0.wp.com/stockmark.it/wp-content/uploads/2026/10/emudhra-exits-tls-certificate-business-following-weak-key.png?fit=1536%2C1024&quality=80&ssl=1" format: "news" language: "en-GB" --- # eMudhra exits TLS certificate business following weak key incident **Published:** October 23, 2026 **Author:** Stockmark.IT Website **Categories:** Business, global markets **Featured image:** ![eMudhra exits TLS certificate business following weak key incident](https://i0.wp.com/stockmark.it/wp-content/uploads/2026/10/emudhra-exits-tls-certificate-business-following-weak-key.png?fit=1536%2C1024&quality=80&ssl=1) --- eMudhra, the Indian certificate authority responsible for issuing eight intermediate TLS credentials with critically weak private keys, has announced it is withdrawing from the global SSL and TLS business. The company stated that the decision follows a detailed board deliberation regarding the disproportionate scrutiny the incident has received on social media. This move marks the end of eMudhra’s participation in the industry, a sector where it had previously issued certificates that could be trivially cracked by anyone with minimal computational effort. One of the compromised private keys was merely the number four, rendering the security of the associated certificates effectively null. V. Srinivasan, chairman of eMudhra Limited, cited increasing compliance costs and complexities as primary drivers for the exit. He noted that the TLS business generated only one per cent of the company’s total revenue. Furthermore, the emergence of organisations providing TLS certificates free of charge had further reduced the return on investment compared to other products and services offered by the firm. In a statement posted on Thursday, the company acknowledged that while the technical failure was significant, the level of public amplification had brought scrutiny that was out of proportion to the actual place of SSL and TLS in its broader business portfolio. The board concluded that withdrawing was the right decision for eMudhra and its shareholders. The announcement came two days after researchers revealed that eMudhra had issued eight certificates with private keys so defective they were easy to discover. The keys ranged in size from three to eight bits, whereas NIST P-384 elliptic curve cryptography private keys are supposed to contain roughly 384 bits of entropy. This means that while standard keys offer a number of possibilities with 116 digits, the strongest of the defective keys had a maximum of just 256 possibilities. The specific private keys involved were 4, 56, 66, 115, 155, 156, 230, and 237. Anyone who took the time to crack these keys, a process measured in milliseconds, could then use them to generate TLS certificates trusted by all major browsers, as well as an untold number of email servers, IoT devices, Docker containers, and other systems that ship their own copy of the roots. Browser makers blocked the certificates issued with the intermediate credentials within a day or two of the discovery. eMudhra likely faced the prospect of its certificate authority status being revoked by the CA/Browser Forum, the industry-wide group that sets rules for admittance into the TLS certificate program. On Wednesday, the company provided a brief explanation for the debacle, stating that the certificates were created under its ECC root in a Key Generation Ceremony held on April 30, 2025, using FIPS 140-2 Level 3 Hardware Security Modules. A flaw in the ceremony caused a wrap and unwrap step to produce a second set of weak keys alongside the original strong keys. It was these weak keys that were published to the browser root stores. In a thread on Mozilla’s Bugzilla forum, eMudhra provided further details, indicating a flaw in the Key Generation Ceremony script used on that specific day. The company’s review suggested that a set of original ECC keys were created as expected, but an approved deviation to test a wrap and unwrap process was introduced. A code flaw resulted in a second pair of weaker keys being created onboard. These weaker keys were used by mistake to create the certificate signing request because the key labels were similar. The request was then signed by the root and also sent to fellow certificate authority Sectigo for cross-signing. The company noted that human errors in multiple steps of the process resulted in significant flaws in the key lifecycle integrity. It is now digging deeper for code flaws and process gaps, and plans to reverify every key ceremony it has conducted over the next week. The certificate revocation lists were initially signed with the original private keys, which were supposed to have appropriate entropy. However, given that this resulted in incorrect signatures, they were resigned with the flawed keys. This raises questions about why eMudhra did not investigate the cause of the initial failure. With the intermediate certificates blocked by browsers, much of the immediate threat has been mitigated. However, plenty of other devices that rely on the same certificates require much longer windows to take the same action. Still other devices, such as embedded systems, may never be able to block them, leaving a residual risk in the wider digital infrastructure. --- **Original URL:** https://stockmark.it/disgraced-emudhra-drops-out-of-tls-business-after-using-cert-private-k/ *Created by [WP Markdown Endpoint](https://wpmarkdownendpoint.com/)*