Disgraced eMudhra drops out of TLS business after using cert private key of 4

The global TLS certificate authority market will become less competitive as eMudhra exits, potentially affecting pricing and availability of certificates.

Indian certificate authority eMudhra is exiting the TLS certificate business following a severe security lapse. The company admitted to issuing eight intermediate TLS certificates with extremely weak private encryption keys, some as low as 3 to 8 bits, which allowed attackers to mint trusted certificates for any website or mail server. This incident came to light when researchers discovered the vulnerabilities, prompting browser makers to block the compromised certificates within days. eMudhra cited the increasing costs of compliance, the business generating only 1% of its revenue, and free TLS certificate providers as reasons for its withdrawal. The company described the flaw as occurring during a key generation ceremony where a flawed wrap/unwrap process created a second set of weaker keys that were mistakenly used for signing.

eMudhra's departure from the TLS market, driven by compliance costs and reputational damage, signals a consolidation trend among certificate authorities. The incident, caused by a flawed key generation ceremony, highlights the critical importance of secure operational procedures and robust internal controls, even for established players. This event could lead to increased scrutiny and stricter auditing requirements from industry bodies like the CA/Browser Forum for all certificate authorities.

The vulnerability exposed by eMudhra underscores the significant risks associated with weak cryptography and the potential for widespread impact on internet security. While major browsers quickly mitigated the immediate threat, many IoT devices and older systems may remain vulnerable, necessitating a longer-term patching strategy. The incident also reinforces the value of organizations like Let's Encrypt, which provide free TLS certificates, potentially pressuring other commercial CAs to re-evaluate their pricing and service offerings.