eMudhra exits global SSL/TLS certificate business after guessable CA keys

· Cybersecurity · India

Indian certificate authority eMudhra will withdraw from its global SSL/TLS certificate business, a decision its board took on Thursday, five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. Cybersecurity researcher Scott Helme publicized the issue, writing that instead of a random 384-bit number, one of the company's private keys was simply the number four. eMudhra said it will replace affected customers' certificates. Because intermediate CA keys underpin the trust chain for certificates issued to customers, their compromise can undermine trust in any certificate the authority signed. The exit is an unusually direct consequence for a CA, a role whose entire value rests on the secrecy of its keys.

Why it matters：It is a rare case of a CA abandoning a business line over key quality, reinforcing scrutiny of the certificate ecosystem that underpins encrypted web traffic.

Key points

  • Eight intermediate CA private keys were reported recoverable.
  • A researcher said one key was simply the number four rather than a random 384-bit value.
  • The board decided on Thursday to withdraw from the global SSL/TLS business.

Sources (original reporting)

More stories from this day