eMudhra to Withdraw from Global SSL/TLS Business
eMudhra, an Indian certificate authority, has announced its decision to voluntarily withdraw from the global SSL/TLS certificate business. The company's board approved this move on Thursday, October 22, 2026, following a significant security incident. The incident involved the discovery that the private keys of eight of eMudhra's intermediate CA certificates were critically weak and easily guessable, with one key reportedly being the number 4.
The decision to exit the business was framed by the company as a strategic business call, influenced by both security concerns and evolving market dynamics. eMudhra stated that the global TLS unit represents a small portion of its wider business portfolio. The company plans to replace affected customers' certificates with free ones provided by partners, though these partners have not yet been named.
Security Incident Prompts Browser Actions
The security incident came to light on October 17, 2026, when an independent security researcher flagged the issue. The vulnerability involved weak private keys in eight intermediate certificate authorities that browsers had previously trusted. By October 20, major browser vendors, including Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft Edge, had taken action to block the affected certificates. This blocking mechanism prevents legitimate certificates issued under these compromised authorities from being trusted by users.
Specifically, Chrome announced that it would stop trusting the eMudhra root certificate, 'emSign ECC Root CA - G3,' above the affected intermediate CAs. This change was expected to be implemented for users on the morning of October 27, Pacific time. Mozilla also decided to stop trusting the same root certificate in Firefox on October 20. Removing a root certificate from a browser effectively cuts off all legitimate certificates issued beneath it.
Impact on Certificate Holders and Revenue
As of October 21, 2026, approximately 30,800 unexpired certificates chained to the compromised eMudhra root were identified in public Certificate Transparency (CT) logs, according to Chrome's count. A significant majority, 99.9%, of these certificates were issued through InCommon, a certificate service established by Internet2 for the higher education community. This indicates a substantial impact on academic institutions relying on eMudhra's services.
eMudhra's Chairman, V. Srinivasan, stated that the global SSL/TLS certificate business contributes only about 1% of the company's global revenue. He also cited increasing data sovereignty and compliance rules as factors that have made operating this business more complex and costly. Furthermore, the competitive landscape, where some large players offer TLS certificates for free, has reduced potential profitability and return on investment for eMudhra.
eMudhra's Response and Business Rationale
eMudhra stated that it revoked the affected certificate authorities within 14 hours of discovering the issue and promptly disclosed the problem to relevant stakeholders. The company emphasized that its core enterprise solutions and other digital trust services remain unaffected by this decision. The withdrawal is seen as a move to mitigate reputational risks associated with the segment while focusing resources on its more robust business areas.
The company also noted that the level of social media amplification surrounding the incident had brought scrutiny that was disproportionate to the SSL/TLS business's overall place within eMudhra's operations. This suggests that while the security incident was the catalyst, the business decision was also influenced by the broader operational and financial considerations of maintaining a global TLS certificate service in the current market.
Technical Details of the Weak Keys
Researchers found that the eight compromised private keys had an extremely low entropy, ranging from just 3 to 8 bits. This is in stark contrast to the NIST P-384 cryptographic standard, which requires approximately 384 bits of entropy for secure keys. The specific values of the discovered weak private keys were identified as 4, 56, 66, 115, 155, 156, 230, and 237. Such low entropy means these keys could be calculated or guessed in milliseconds, enabling malicious actors to impersonate legitimate websites or mail servers by issuing fraudulent certificates.
The incident highlights the critical importance of robust key management practices in the Public Key Infrastructure (PKI) ecosystem. Failures in this area can have widespread consequences, affecting trust in digital identities and secure communication channels. The rapid response from browser vendors underscores the industry's commitment to maintaining the integrity of the web's security infrastructure.
What This Means
eMudhra's exit from the global SSL/TLS certificate business signifies a significant shift for the company and potentially for its affected customers, particularly within the higher education sector. The decision, triggered by a critical security flaw involving easily guessable private keys, underscores the high stakes and stringent security demands of operating as a Certificate Authority (CA). The swift action by major browsers to block eMudhra's certificates demonstrates their role as gatekeepers in maintaining web security and trust.
For users and organizations relying on certificates issued under the compromised eMudhra root, the primary concern will be the seamless transition to new, trusted certificates. The fact that eMudhra plans to offer free replacements through partners is a necessary step, but the specifics of this transition, including the identity of the partners and the timeline, will be crucial. This event also serves as a cautionary tale for other CAs, emphasizing the need for continuous vigilance in cryptographic key management and the potential consequences of even minor security lapses in a highly interconnected digital world. The increasing complexity and cost of compliance, coupled with competitive pressures, suggest that the SSL/TLS market may continue to consolidate or see further strategic realignments.
💬 Comments (0)