eMudhra says it will exit the SSL/TLS certificate business, 1% of its revenue, after its TLS certificates with private keys of just 3 to 8 bits were compromised
Indian digital trust services provider eMudhra (EMUD.NS) on Thursday said it would voluntarily withdraw from the global SSL/TLS …
ReutersAbhirami G
Context & Ripple Effects
The withdrawal follows the discovery that eight eMudhra intermediate certificates used private keys of only 3 to 8 bits, after which browser makers and major apps blocked the affected intermediates. eMudhra says the global SSL/TLS unit represents 1% of its revenue, making the move a contained financial line item but a consequential retreat from a trust-critical service.
The episode fits a longer record of certificate compromises, including the theft of more than 200 SSL certificates reported in 2011. Here, the immediate enforcement by browser and app platforms demonstrates how quickly an issuer can lose practical reach when its key management fails.
First-order effects
eMudhra will stop participating in the global SSL/TLS certificate business, while the eight compromised intermediates remain unusable in browsers and major applications that blocked them.
Organizations relying on eMudhra for global TLS certificates must shift issuance or renewal to another trusted certificate authority.
Second-order effects
Other certificate authorities can absorb replacement and renewal demand, while customers and their hosting or security providers face migration and certificate-lifecycle work.
Browser and application makers’ blocking action makes their root-program enforcement the decisive operational constraint on issuers, rather than a reputational dispute alone.
Third-order effects
The incident reinforces a trust-layer market in which certificate authorities are interchangeable only until a cryptographic control failure triggers ecosystem-wide exclusion.
If browser and app platforms continue to act jointly against weak issuers, certificate issuance will be shaped increasingly by centralized technical governance and auditable key-management practices.
The trend: Global TLS trust is consolidating around browser-enforced standards, with cryptographic failures capable of ending an issuer’s effective market access.
eMudhra claim they're leaving the SSL/TLS business because they're being criticised on social media. It's more likely that they've realised they will probably be fully removed anyway, so they're bowing out now. https://emudhra.com/... [image]
A private key that was the number 4 just ended a CA's global TLS business. — eMudhra's Board has decided to withdraw from the global SSL/TLS certificate business …
This announcement of “eMudhra to Exit global SSL/TLS Certificate Business” by @eMudhra is only raking up the rank stink. They should undergo a thorough Digital and Financial Forensic Audit and their assets should get frozen with immediate effect. https://emudhra.com/...
Due to extreme incompetence eMudhra is leaving the SSL/TLS cert business. Good riddance. May you lose every single customer you have. You have lost all trust. https://emudhra.com/...
eMudhra says it will voluntarily exit the global SSL/TLS certificate business. — They also promised a root-cause report, but “our cryptography was built on vibes and hopes” should cover it. — https://emudhra.com/...
eMudra, the certificate authority that issued eight intermediate TLS credentials so weak that anyone could mint certificates for any website or mail server—one had a private encryption key of just 4—said it's getting out of the business. — arstechnica.com/security/202...