Ethical Hacking News
India's eMudhra, a key player in the global SSL/TLS certification market, has announced its decision to abandon its global business after a scandal involving weak private keys compromised the trust and reputation of the company. The move comes as a result of the intense scrutiny heaped on the company following the revelation of its private keys, with one of them being the number '4'. The decision is seen as a strategic move by eMudhra to distance itself from the controversy and minimize the negative impact on its reputation. The company will continue to serve G1 RSA roots until it transitions customers to other certificate issuers, which it will do free of charge. Revocation and certificate status services will also continue to run until every issued certificate has expired or been replaced.
Indian certification authority eMudhra has abandoned its global SSL/TLS certification business due to a scandal involving weak private keys. The weak keys were a result of a flaw in the key-generation ceremony, and the company had already revoked the affected CAs within 14 hours. The scandal has raised questions about why the weak keys weren't caught sooner, despite the certificate infrastructure undergoing two years of independent audits. eMudhra plans to continue serving its customers with a free transition to other certificate issuers and will maintain revocation and certificate status services until all certificates expire. The incident has sparked a debate about the reliability and trustworthiness of certificate authorities and the need for rigorous testing and auditing procedures.
The Indian certification authority eMudhra has made the shocking decision to abandon its global SSL/TLS certification business after a scandal involving weak private keys compromised the trust and reputation of the company. The move comes as a result of the intense scrutiny heaped on the company following the revelation of its private keys, with one of them being the number '4', a value that was deemed laughable and easy to guess by security researchers.
According to eMudhra, the weak keys were a result of a flaw in the key-generation ceremony that produced a second set of weak keys alongside the intended strong ones. The company claimed that the affected CAs had issued no end-entity certificates, and that it had revoked those CAs within 14 hours of discovering the issue. However, the incident has raised questions about why the weak keys weren't caught sooner, given that the relevant certificate infrastructure had undergone two years of independent audits and had been in browser trust lists since mid-2025.
The scandal has given eMudhra another reason to shave off a small part of its business rather than continue facing scrutiny over its certificate operations. The company stated that global SSL/TLS accounts for only 1 percent of its global revenue, and that the level of social media amplification around this incident has brought scrutiny that is out of proportion to the business's place in eMudhra's operations.
The decision to abandon the global SSL/TLS business is seen as a strategic move by eMudhra to distance itself from the controversy and minimize the negative impact on its reputation. The company will continue to serve G1 RSA roots until it transitions customers to other certificate issuers, which it will do free of charge. Revocation and certificate status services will also continue to run until every issued certificate has expired or been replaced.
The incident has sparked a debate about the reliability and trustworthiness of certificate authorities, particularly in light of the growing importance of online security and the increasing reliance on digital certificates. As eMudhra exits the global SSL/TLS market, other certificate authorities must be held to higher standards to maintain the trust and confidence of users.
In the wake of this scandal, eMudhra has demonstrated a commitment to transparency and accountability, even in the face of intense scrutiny. The company's decision to abandon its global SSL/TLS business is a testament to its willingness to prioritize its reputation and the trust of its customers over the potential benefits of continuing to operate in the market.
As eMudhra moves forward, it will be crucial for the company to rebuild its reputation and establish a new standard for certificate authority security. The incident has highlighted the need for rigorous testing and auditing procedures to ensure the security and reliability of digital certificates. Only by doing so can eMudhra and other certificate authorities regain the trust of users and maintain the integrity of the online security ecosystem.
Related Information:
https://www.ethicalhackingnews.com/articles/Disgraced-Indian-Cert-Issuer-Abandons-Global-SSLTLS-Business-Amid-Scandal-Over-Weak-Private-Keys-ehn.shtml
https://www.theregister.com/security/2026/10/22/disgraced-indian-cert-issuer-leaves-the-cert-issuing-business/5304848
Published: Thu Oct 22 13:13:43 2026 by llama3.2 3B Q4_K_M
