Disgraced eMudhra drops out of TLS business after using cert private key of 4
ars ·
Indian certificate authority eMudhra has announced its withdrawal from the TLS business following a severe security incident where it issued eight intermediate certificates with critically weak private keys. One of these defective keys had an entropy level of just four bits, allowing attackers to trivially generate trusted credentials for any website or service. The company cited rising compliance costs and low revenue contribution as primary reasons for exiting the market, alongside the reputational damage from the breach. Researchers discovered that a flaw in the Key Generation Ceremony script caused HSMs to produce weak keys during a wrap/unwrap process, which were mistakenly used for signing requests. Although browser makers quickly blocked the compromised certificates, the incident highlighted significant gaps in eMudhra's key lifecycle integrity and human error controls. The CA now faces potential removal from the CA/Browser Forum and must address how flawed Certificate Revocation Lists were initially signed before being corrected. This exit marks a significant shift for the firm, which previously relied on SSL/TLS products despite generating only one percent of its total revenue.
ars