eMudhra, an India-based certificate authority, is exiting the global SSL/TLS business after its board determined the unit's risk-to-reward ratio no longer justified continued investment.
The decision follows the disclosure that eMudhra had issued eight intermediate TLS credentials with severely weak private encryption keys—some as low as 4 bits. Any of the defective keys could be cracked in milliseconds, allowing attackers to forge certificates trusted by browsers, mail servers, and IoT devices.
V. Srinivasan, chairman of eMudhra Limited, said the TLS business generated just 1 percent of total revenue while facing mounting compliance costs. The unit also faced the structural headwind of free certificate providers eroding margins across the sector.
The company acknowledged the reputational damage. Srinivasan noted the level of social media scrutiny following the incident was disproportionate to the SSL/TLS business's strategic importance to eMudhra.
Browser makers blocked certificates issued by the compromised intermediates within one to two days of discovery. eMudhra faced a strong likelihood of having its certificate authority status revoked by the CA/Browser Forum, the industry group that sets admission rules for TLS programs.
The defect emerged during a Key Generation Ceremony held April 30, 2025. eMudhra used FIPS 140-2 Level 3 Hardware Security Modules for the process. Standard NIST P-384 elliptic curve keys contain roughly 384 bits of entropy—2^384 possibilities. The eight compromised certificates had key sizes ranging from 3 to 8 bits, with the strongest offering only 256 cracking possibilities.
eMudhra attributed the flaw to a malfunction in the HSM wrap/unwrap step, which produced a second set of weak keys alongside the intended strong keys. The company is investigating the root cause.
