eMudhra Quits Global SSL/TLS Business After Eight CA Keys Turn Out to Be Guessable

Indian certificate authority eMudhra will withdraw from its worldwide SSL/TLS certificate business. Its board made the decision on Thursday — five days after a researcher reported recovering the private keys of eight of the company's intermediate CA certificates.

The reason is awkwardly simple. Each private key should have been an enormous random number, yet all eight came in below 256, so anyone could work them out almost instantly. The researcher notified Apple, Google, Microsoft, Mozilla and eMudhra itself on October 17.

A root loses trust

Six of the eight keys belonged to website certificates. Above them sits the root emSign ECC Root CA — G3, and Chrome will stop trusting it on the morning of October 27, Pacific time. Mozilla reached the same conclusion for Firefox back on October 20. Pulling a root from a browser also severs every legitimate certificate issued beneath it.

By Chrome's count of public Certificate Transparency logs on October 21, about 30,800 unexpired certificates chained to that root. Of those, 99.9% were issued through InCommon, the service Internet2 built for the higher-education community. Between April and July this year, InCommon moved that service onto eMudhra's CertiNext platform.

Google has told affected site operators to immediately acquire and install a new certificate from another PKI hierarchy. Chrome and Firefox blocked the six intermediate TLS certificates within hours; according to Google, none had appeared in CT logs, so none could have been used against the browsers in practice.

What holders can do

Cornell, with more than 300 affected certificates of its own, is telling holders to request RSA certificates instead of ECC ones, since those rely on the unaffected G1 root. The University of Michigan warns that this root "could become distrusted, too," and for now points users to Let's Encrypt.

eMudhra estimates roughly 30,000 certificates need moving, about 97% of them issued via ACME. The catch: standard ACME clients will not replace certificates outside their renewal window without ARI support or manual intervention.

Doubts over the RSA root

Trust in the G1 root remains for now, but suspicion is gathering there too. On October 14, eMudhra published a revocation list (CRL) for the intermediate emSign Root TLS CA — G1 whose signature does not verify against that CA's own key. It appears to have been signed with the key of an eMudhra OCSP certificate — probably the wrong signing key rather than another weak one.

More troubling is a 2025 echo. Back then eMudhra published invalid CRLs for six of the same intermediates and, it now emerges, re-signed them with the very weak keys found this month. Chrome called this a reason for "serious concerns regarding eMudhra's transparency," and asked why the 2025 report never mentioned that two key pairs existed for those CAs. As of publication, eMudhra had not answered.

eMudhra maintains the eight keys were never used to issue certificates and that its systems were not breached. The global SSL/TLS line brought in about 1% of the company's revenue.

Source: The Hacker News