Disgraced eMudhra drops out of TLS business after using cert private key of 4
Summary
India-based company eMudhra is stopping its TLS certificate business after it issued eight weak encryption keys that could be easily hacked. The company cited high compliance costs, low revenue, and competition from free certificate providers as reasons for exiting the market.Key Facts
- eMudhra issued eight TLS intermediate certificates with very weak private keys, some as small as 4 bits, making them easy to break.
- TLS certificates help secure websites and mail servers by encrypting data and verifying identities.
- These weak keys allowed anyone to create fake certificates trusted by major browsers and many devices.
- Browser makers quickly blocked certificates linked to these weak keys to protect users.
- The problem happened due to a flaw in a certificate creation process called the Key Generation Ceremony on April 30, 2025.
- eMudhra used special hardware security devices (HSMs) to create keys, but a software error caused weak keys to be published instead of strong ones.
- The company said the TLS business made only 1% of its revenue and stopped because of high costs and free competitors.
- eMudhra's certificate authority status was at risk due to the security failure.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
