Certificate authority eMudhra is exiting the TLS business after researchers revealed it had issued eight intermediate certificates with critically weak private keys, including one as small as 4 bits, which could be trivially cracked to forge trusted certificates for any website or mail server. The company cited rising compliance costs and competition from free certificate providers as reasons for withdrawal, though the incident has drawn disproportionate scrutiny given TLS's limited role in its overall business.
Background
eMudhra is an India-based certificate authority that has faced multiple security incidents; this latest debacle follows previous controversies over inadequate security practices. TLS certificate issuance is a critical component of internet security, requiring rigorous key generation and management to prevent impersonation attacks.
- Source
- Ars Technica
- Published
- Oct 23, 2026 at 04:17 AM
- Score
- 9.0 / 10