GoKawiileMudhra exits global TLS certificate business after flawed key disclosure
eMudhra, an Indian certificate authority, announced it is withdrawing from the global SSL/TLS certificate business days after researchers found it had issued eight intermediate certificates with critically weak private keys—one containing just 4 bits of entropy instead of the expected 384. Chairman V. Srinivasan said the decision stemmed from rising compliance costs, the TLS business contributing only 1 percent of revenue, and competition from free certificate providers.
GoKawiil's interpretation of the reporting above, not reported fact.
The flawed keys could have let attackers forge trusted certificates for virtually any website, email server, or connected device, exposing a systemic risk in the certificate authority ecosystem. eMudhra's framing suggests the exit is partly a business decision rather than solely a security response, which could raise questions about accountability in the CA industry and how browser trust programs respond to future incidents.
- eMudhra issued eight TLS certificates with critically weak private keys, one with only 4 bits of entropy.
- The company is exiting the global SSL/TLS certificate business, citing cost, low revenue share, and competition from free CAs.
- The incident highlights risks in the certificate authority system that underpins trust across browsers, email servers, and connected devices.
Source: arstechnica.com, 2026-10-22
Published there as: “Disgraced eMudhra drops out of TLS business after using cert private key of 4”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.