Key facts
- eMudhra is exiting the SSL/TLS certificate business.
- Eight intermediate TLS credentials were issued with weak private keys.
- The compromised keys had entropy as low as 3 bits.
- Browser makers blocked certificates issued with the flawed keys.
- eMudhra cited compliance costs and low revenue as reasons for exiting the business.
India-based eMudhra, a certificate authority, announced its withdrawal from the global SSL/TLS business following a security incident where it issued eight intermediate TLS credentials with critically weak private encryption keys. These keys, with entropy as low as 3 bits, could be easily cracked, allowing attackers to mint fraudulent certificates trusted by browsers and other devices. Browser makers quickly blocked these certificates. eMudhra cited increasing compliance costs, the business contributing only 1% of its revenue, and disproportionate scrutiny following the incident as reasons for the decision. The company explained the flaw stemmed from an error in a Key Generation Ceremony script that produced weaker keys alongside the intended strong ones.