eMudhra Exits TLS Business Following Key Generation Failure That Enabled Certificate Forgery

Image: Ars Technica · Source

After a critical flaw allowed the issuance of trivially crackable TLS certificates, Indian certificate authority eMudhra announced its withdrawal from the TLS certificate market, citing compliance costs and low revenue.

In a significant blow to its credibility and operations, Indian certificate authority eMudhra has declared its exit from the global TLS certificate business following a severe security incident. This incident involved the issuance of eight intermediate TLS certificates with critically weak private keys, some containing as few as 4 bits of entropy. These inadequately secured keys enabled anyone to generate trusted TLS certificates for virtually any website or email server, posing a global security risk.

The flaw originated during a key generation ceremony conducted on April 30, 2025, utilizing FIPS 140-2 Level 3 Hardware Security Modules (HSMs). A bug in the ceremony's process introduced a wrap/unwrap step that inadvertently created a second set of weaker keys alongside the intended secure keys. These weak keys were mistakenly published to browser root stores, allowing attackers to exploit them to create counterfeit certificates recognized by all major browsers and many other devices.

The weak keys ranged from just 3 to 8 bits in size, drastically under the expected 384 bits of entropy required for elliptic curve cryptography keys. For context, the strongest flawed key had only 256 possible values, which is trivially breakable.

Following public disclosure, browser vendors swiftly blocked certificates associated with these compromised intermediates. eMudhra's chairman, V. Srinivasan, cited increasing compliance challenges, low business revenue from TLS certificates—only about 1 percent—and the rise of free certificate providers as factors contributing to the decision to withdraw.

In communications on Mozilla's Bugzilla forum, eMudhra acknowledged multiple human errors and procedural failures that compounded the problem. They noted that the defective keys were used in the certificate signing requests and even in signing certificate revocation lists (CRLs), which initially produced incorrect signatures requiring re-signing.

Though browser mitigation has limited the immediate threat, many embedded and less frequently updated devices that rely on these certificates remain vulnerable. eMudhra is conducting a comprehensive review of all key ceremonies to identify overlooked weaknesses.

This episode underscores the critical importance of rigorous cryptographic key management processes and the risks posed when such processes falter. Industry watchdogs like the CA/Browser Forum are expected to reconsider eMudhra's certification authority status following this incident.