eMudhra Limited, an India-based certificate authority, is exiting the global SSL/TLS certificate business. The company's board concluded that the withdrawal makes economic sense for shareholders, citing rising compliance costs and returns on investment eroded by free TLS certificate providers like Let's Encrypt.
The SSL/TLS segment generated just 1 percent of eMudhra's total revenue.
V. Srinivasan, chairman of eMudhra Limited, said the social media scrutiny following a recent security incident was disproportionate to the business's importance. The announcement came two days after researchers disclosed a critical vulnerability in eight certificates issued by eMudhra.
Those eight intermediate TLS credentials possessed private encryption keys so weak they could be cracked in milliseconds. One key had a value of just 4. Attackers using these compromised keys could have forged TLS certificates trusted by major web browsers, email servers, IoT devices, Docker containers, and Linux machines.
Browser makers moved to block certificates issued with the defective intermediates within one to two days of discovery.
eMudhra's certificates used NIST P-384 elliptic curve cryptography, which generates approximately 384 bits of entropy—equivalent to 2^384 possible key combinations, a 116-digit number. The eight compromised certificates had key sizes ranging from 3 to 8 bits, with the strongest offering only 2^56 possibilities. The specific compromised key values were 4, 56, 66, 115, 155, 156, 230, and 237.
eMudhra attributed the flaw to a Key Generation Ceremony on April 30, 2025, conducted using FIPS 140-2 Level 3 Hardware Security Modules. During the KGC, a wrap/unwrap step produced weak keys alongside intended strong keys, which were subsequently published to browser root stores. The company is investigating the root cause of the KGC failure.
The incident also threatens eMudhra's status with the CA/Browser Forum, the industry group that establishes TLS certificate program rules.
