eMudhra Exits Global TLS Certificate Business After Eight Keys Compromised

The failure involved eight intermediate certificate authorities operated by Indian digital certificate provider eMudhra. Their private keys were so weak that researchers could recover them almost instantly, according to BleepingComputer.

Intermediate certificate authorities sign other certificates. Compromising their keys could let attackers forge trusted certificates and impersonate websites or applications, Computerworld reported. This was a weakness in the credentials used to establish trust, not simply a problem with one website.

One recovered private key was just the number 4, according to The Next Web. Its reporting said anyone could calculate the eight private keys from the certificates themselves.

On October 19, at approximately 17:00 UTC, Cloudflare became aware that private keys associated with eight eMudhra intermediate certificates were compromised, according to The Cloudflare Blog. The certificates were widely trusted by browsers and other software.

On October 20, Mozilla and Google's Chrome Root Program confirmed the compromise, The Hacker News reported. The discovery prompted emergency fixes across browsers and software.

By October 21, eMudhra had revoked the eight intermediate certificates, and Mozilla, Google and Apple had blocked them, according to BleepingComputer. India's CERT-In also issued an advisory urging users to update browsers and operating systems and replace certificates, Business Line reported.

The Indian government announced a special investigation team on October 21. It said electronic signature services were unaffected, according to NDTV India. The government also described the impact on Indian websites and applications as very limited, Times now reported.

On October 22, eMudhra said its board had decided to withdraw voluntarily from the global SSL/TLS certificate business, according to The Next Web. The decision followed the browser blocks and growing scrutiny of how the weak keys had escaped detection.

The affected certificates have been revoked and blocked by major browser providers, while eMudhra is leaving the global SSL/TLS certificate business, according to BleepingComputer and The Next Web. The Indian investigation remains a separate question from those immediate containment measures.

The coverage describes a capability to forge trusted certificates, rather than establishing that attackers actually used the keys to impersonate sites. The government's limited-impact assessment also does not remove questions about the original failure.

Scrutiny now includes the audit process. eMudhra said the flaw went undetected through two independent audit cycles, The Defiant reported. Experts have called for greater accountability from both the company and the Controller of Certifying Authorities, which receives its audit reports, according to NDTV.

The government's investigation is the next source of answers about how the keys were generated and why checks missed the weakness. Business Line also reported that the government was looking at domestic alternatives as eMudhra exits the global business.

For users and organisations managing certificates, the immediate guidance is more concrete: update browsers and operating systems, and replace affected certificates, as CERT-In advised, according to Business Line.