Certificate Authority eMudhra Exits SSL/TLS Business After Researchers Crack Its Weak Keys in Under a Second

Indian certificate authority eMudhra has announced it will stop issuing SSL/TLS certificates, days after researchers showed that the private keys securing eight of its intermediate certificates could be reconstructed in under a second. Major browsers had blocked the certificates, and Indian authorities launched an investigation.

The problem began when a researcher alerted Apple, Google, Microsoft and Mozilla that the keys could be worked out from the public certificates, because they were created with too little randomness. Security researcher Scott Helme recovered all eight on his laptop in less than a second. Normally a private key is a number roughly 77 or 78 digits long, but each of these was a whole number below 256, and one was simply the number 4. Anyone could have tested every possible value in seconds and used the result to forge certificates and impersonate websites.

eMudhra blamed an error in a key generation ceremony held in April 2025, which it said produced a second, weak set of keys that was published to browser trust lists instead of the intended ones. The company said its infrastructure was not compromised, no data was breached, and none of the eight intermediates had issued end-entity certificates. Whether anyone used the weak keys is not known. Chairman V. Srinivasan said the exit reflected rising compliance costs and competition from providers offering certificates free of charge.