eMudhra exits global TLS business after private key defects

eMudhra Withdraws From Global TLS Business Following Private Key Defects

Certificate authority eMudhra announced it is exiting the global SSL/TLS market after researchers discovered the company issued eight intermediate certificates with critically weak private keys. V. Srinivasan, chairman of India-based eMudhra Limited, cited escalating compliance costs, increasing technical complexities, and low revenue return as primary drivers for the corporate withdrawal.

The Disproportionate Scrutiny of Defective Certificate Authorities

The corporate exit follows disclosures revealing that eMudhra issued eight TLS credentials featuring private keys so mathematically deficient that attackers could easily derive them. While NIST P-384 elliptic curve cryptography private keys require approximately 384 bits of entropy—yielding $2^{384}$ possible key permutations—the compromised certificates utilized key sizes ranging from 3 to 8 bits. The strongest of the defective keys held a maximum limit of just 256 possibilities. Consequently, adversaries could crack the private keys in milliseconds to generate rogue TLS certificates trusted automatically by major browsers, email servers, IoT devices, Docker containers, and unmaintained Linux CLI tools.

eMudhra characterized the resulting backlash as disproportionate to the actual business segment involved. However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business, the company stated. In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.

Compliance Costs Versus Free Certificate Infrastructure

The announcement arrives just two days after the vulnerability findings became public. Srinivasan noted that the rise of organizations providing TLS certificates free of charge severely compressed profit margins for commercial issuers. When weighed against other products and services offered by the firm, the operational overhead of maintaining global certificate authority compliance no longer justified the expenditure, particularly given that the TLS division generated a mere 1 percent of total company revenue.

# Example command to inspect a suspicious certificate key size via OpenSSL
openssl x509 -in certificate.crt -text -noout | grep -A 2 "Public Key Algorithm"

Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.