Certificate Authority Quits Global SSL/TLS Business After Absurdly Weak Keys Exposed

eMudhra, an Indian certification authority, has announced it will withdraw from the global SSL/TLS certificate business. The decision follows public reports of weak private keys tied to its systems, after a report was made to Mozilla on 17 October. The company says SSL/TLS made up only about 1 percent of its global revenue, and that free certificates from large providers, rising compliance costs and data sovereignty requirements had already made the business hard to justify. It also said social media attention had brought scrutiny out of proportion to that part of its operations.

The flaw itself was striking. Eight private-key values were exposed, ranging from the number 4 to 56, 66, 115, 155, 156, 230 and 237. These were simple enough that security researchers could recover them without any special computing power. The keys belonged to eight intermediate certificate authorities, which could potentially have allowed attackers to forge certificates trusted by systems that had not blocked them.

eMudhra maintains that the affected intermediate CAs had issued no end-entity certificates, meaning none were used to issue certificates to websites or users. This summary is based on the opening of the source article, so further details of the investigation and any wider response are not covered here.