eMudhra exits global SSL/TLS certificate market after weak key breach

An anonymous security researcher identified weak private keys in eight certificate authorities operated by eMudhra, prompting browsers like Google Chrome and Mozilla Firefox to reject the certificates after an 18-month exposure period. The vulnerability survived two external audit cycles before being disclosed, leading eMudhra to voluntarily cease its global SSL/TLS certificate operations, a line that contributed roughly 1% of its revenue.

Co-founder Kaushik Srinivasan attributed the issue to a scripting mistake and oversight, assuring that no customer data was compromised and that Indian eSign services continue on separate infrastructure. Mozilla warned that recovered keys could enable website impersonation and traffic interception. eMudhra’s board decided to exit the business to focus on higher-margin enterprise offerings, and an independent auditor will review both the incident and the company’s entire cryptographic estate, with findings to be published publicly. Credit rating agency ICRA left the firm’s ratings unchanged, noting the limited financial impact.