eMudhra Limited, an India-based certificate authority, is withdrawing from the global SSL/TLS certificate business after researchers revealed it had issued eight intermediate TLS certificates with severely weak private encryption keys.
Chairman V. Srinivasan said the SSL/TLS segment generated only 1 percent of company revenue and that rising compliance costs made the business unviable. Free certificate offerings from competitors like Let's Encrypt had already eroded margins.
The decision accelerated after browsers began blocking eMudhra's certificates within days of the discovery. The company faces likely revocation of its certificate authority status by the CA/Browser Forum, the industry group governing TLS program admittance.
The technical failure reveals how a single flaw in cryptographic key generation can demolish an entire business line. On April 30, 2025, during a Key Generation Ceremony using FIPS 140-2 Level 3 Hardware Security Modules, a wrap/unwrap defect produced eight keys with minimal entropy alongside properly generated ones. eMudhra published the weak keys to browser root stores.
The compromised private keys had values of 4, 56, 66, 115, 155, 156, 230, and 237—generating at most 256 possible combinations (2^8). NIST P-384 elliptic curve keys are designed for approximately 384 bits of entropy, or 2^384 possibilities. Cracking eMudhra's strongest defective key would take milliseconds. Anyone exploiting these keys could issue TLS certificates trusted by major browsers, email servers, IoT devices, Docker containers, and legacy software.
eMudhra said it is investigating the root cause of the key generation failure. The company has not disclosed whether the defect affected other certificate operations or if additional weak keys exist.
