Ethical Hacking News
Disgraced Indian certification authority eMudhra has blamed a software bug for issuing weak digital certificates, leading to a damaged reputation and a decision to quit the SSL/TLS certification business. The company will take steps to strengthen its operations and provide support to affected organizations.
eMudhra issued digital certificates with a faulty software bug that made them insecure and easily replicable. The bug was in a custom Python script that truncated private keys to 47 bytes, compromising the security of the certificates. Browser-makers quickly rejected the certificates, rendering them useless, and the company's decision to quit the business was a difficult one. eMudhra outlined three steps to rectify the situation, including improving PKI operations, developing a new certification program, and providing support to affected organizations.
The Indian certification authority eMudhra has recently made headlines for its role in issuing digital certificates that were deemed to be hopelessly weak, thanks to a faulty software bug. The company, which is no longer in the business of issuing SSL/TLS certificates, has taken responsibility for the debacle and has outlined the steps it will take to rectify the situation.
According to eMudhra's account, the bug was introduced in a custom Python script that was used to generate ECDSA P-384 private keys. The script contained a bug in the import code, which resulted in the private keys being truncated to a length of 47 bytes instead of the expected 48 bytes. This truncation had a significant impact on the security of the certificates, as it allowed for the recovery of the private scalars from the public information.
The bug was first noticed by a Mozilla team member, who pointed out that the company's keys were woefully weak and could be used to issue fraudulent certificates. Browser-makers quickly tweaked their software to prevent recognition of eMudhra's certificates, effectively rendering them useless.
eMudhra's decision to quit the SSL/TLS certification business was reportedly not a major source of revenue, but had suddenly become a severe source of embarrassment for the company. The Indian business had struggled to acquire the necessary hardware security modules (HSMs) to generate and store cryptographic keys, and had therefore resorted to using a custom Python script to work around the hardware limitations.
However, the use of a custom script proved to be a recipe for disaster, as the company failed to test the generated keys thoroughly and did not notice the errors in the script until it was too late. The consequences of this were severe, with browser-makers and other organizations quickly rejecting eMudhra's certificates and leaving the company with a damaged reputation.
In an effort to rectify the situation, eMudhra has outlined three steps that it will take to wind down its certification business. These include:
* Putting in place improvements motivated by the findings of an independent review to strengthen its general PKI operations.
* Developing a new certification program that will be designed from the ground up to be more secure and reliable.
* Providing support to organizations that have already issued certificates from eMudhra, in order to help them transition to alternative certification authorities.
It is unclear what the future holds for eMudhra, but it is clear that the company's decision to quit the SSL/TLS certification business was a difficult one. The incident serves as a reminder of the importance of ensuring that software and hardware are thoroughly tested and validated before they are used in production environments.
Related Information:
https://www.ethicalhackingnews.com/articles/Disgraced-Indian-Certification-Authority-Blames-Software-Bug-for-Issuing-Insecure-Digital-Certificates-ehn.shtml
https://www.theregister.com/security/2026/11/12/disgraced-former-ca-emudhra-blames-buggy-script-for-hopelessly-weak-certificates/5309244
Published: Wed Nov 11 22:40:52 2026 by llama3.2 3B Q4_K_M
