Wire reporting: (Reuters, via CNA)

Primary source: eMudhra exit statement

eMudhra Ltd., an Indian certificate authority, said Thursday, Oct. 22, that its board had decided to voluntarily leave its worldwide SSL/TLS certificate business, which browsers use to confirm a website is genuine^1,2,6,8. The decision follows Google and Mozilla's blocking of eight eMudhra intermediate certificate authorities over weak private keys on Saturday, Oct. 17^3,4.

The company said global SSL/TLS brings in about 1% of its revenue, and that rising compliance costs, along with providers that issue certificates free, had shrunk returns^1,8. It said social-media attention had put it under scrutiny it considers out of proportion to that line's size, adding: "For eMudhra it is one part of a much broader digital solutions portfolio"¹.

Google said on Oct. 20 that the eight keys were generated with too little randomness, which let anyone forge trusted HTTPS certificates against clients that still trusted those authorities³. The Hacker News, citing the researcher, said each private key was a number below 256 and that Apple, Google, Microsoft, Mozilla and eMudhra were notified Oct. 17⁶. Google said it was removing the signing root, emSign ECC Root CA - G3, from the Chrome Root Store by the morning of Tuesday, Oct. 27, Pacific time³. Mozilla said it blocked the certificates in Firefox and is removing the same root from NSS⁴.

Ars Technica listed the eight private keys as 4, 56, 66, 115, 155, 156, 230 and 237⁷. It cited eMudhra saying they were created in an April 30, 2025, key-generation ceremony, and that a wrap/unwrap flaw produced weak keys published to browser stores⁷. On Mozilla's bug, Ars said eMudhra wrote that similar key labels led the weaker pair to be used for the certificate signing request, which was also sent to Sectigo for cross-signing⁷. Ars said devices that ship their own root copies may take longer than browsers to block the intermediates⁷.

Google said its root program was investigating whether eMudhra's remaining CA certificates should stay in the Chrome Root Store; the exit statement does not mention that review^3,1. Chairman V. Srinivasan said the company revoked the affected authorities within 14 hours of discovery and that no end-entity certificates were issued from them¹. eMudhra said its infrastructure and security controls stayed intact and that no data was breached¹. Google said no certificates chaining to the affected intermediates had been logged to Certificate Transparency before its block, so none could have been used against clients that enforce it, including Chrome³.

eMudhra said its G1 RSA roots will keep serving customers until the transition is complete, that it will replace certificates free through partners, and that revocation services will run until issued certificates expire or are replaced¹. It said it will finish its root-program commitments, including a full root-cause report¹. The Hacker News noted the statement did not name the partners or give an exit date⁶.

Chrome counted about 30,800 unexpired certificates chaining to the ECC root as of Oct. 21; The Hacker News, citing Mozilla's bug, said 99.9% were issued through InCommon, Internet2's higher-education certificate service⁶. Google told operators they must immediately get a new TLS certificate from another PKI in the Chrome Root Store^3,6. eMudhra estimated about 30,000 certificates need to be moved, about 97% issued using ACME⁶.

Cornell told holders to request RSA certificates instead of ECC ones, counting more than 300 of its own as affected⁶. eMudhra said its digital-signature, eSign and enterprise PKI products, including those in India, are unaffected¹. Reuters reported India's Computer Emergency Response Team said Wednesday that some eMudhra intermediate certificates were compromised, and that eMudhra shares had dropped 40% over two days^2,5.

The Hacker News, citing Mozilla bug 2083449, reported that a revocation list eMudhra published Oct. 14 did not verify against that CA's key, and that Chrome posted 12 questions on the bug Oct. 21 that were unanswered as of 13:31 UTC Thursday⁶. Reuters reported that eMudhra certificates secure some Indian online public services, including the income tax portal^2,5. The statement does not say how many customers must replace certificates¹. The root-cause report had not been published as of Thursday¹.

Sources

1. eMudhraeMudhra to Exit Global SSL/TLS Certificate BusinessOct 22, 9:33 AM
2. ReutersIndian firm eMudhra exits global digital certificates business after vulnerability disclosureOct 22, 8:40 AM
3. Google Chrome and Android Security TeamsProtecting Chrome and Android Users from Compromised eMudhra Intermediate CA CertificatesOct 20, 3:49 PM
4. Mozilla Security BlogProtecting Firefox users following the compromise of eMudhra intermediate certificatesOct 20, 8:54 AM
5. (Reuters, via CNA)Indian firm eMudhra exits global digital certificates business after vulnerability disclosureAlso (Reuters, via Hindustan Times)Oct 22, 8:35 AM

The Hacker News · Ars TechnicaShowHide

1. The Hacker NewseMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily GuessableOct 22, 2:12 PM
2. Ars TechnicaDisgraced eMudhra drops out of TLS business following certificate debacleOct 22, 4:17 PM

Read the original at eMudhra ↗