eMudhra to Exit Global Certificate Business After Weak-Key Flaw

Indian digital-security company eMudhra is exiting its global business issuing website security certificates after Google, Apple and Microsoft stopped trusting certificates linked to vulnerabilities, Reuters reported. The company’s customers include businesses and government agencies, including India’s income-tax portal.

The problem involved eight cryptographic keys generated in April last year. eMudhra co-founder Kaushik Srinivasan told Reuters that software mistakenly shortened the keys, making them significantly weaker and easier to attack. The company said the vulnerability had gone undetected for 18 months and passed two audits.

Why certificate trust matters

SSL/TLS certificates help establish encrypted connections between users and websites. They also identify the entity controlling a site. If a certificate authority is compromised, an attacker may be able to impersonate a website, warned independent security consultant Lukasz Olejnik, quoted by Reuters.

Browsers moved quickly to distrust the affected certificates. Older internet-connected devices may remain exposed longer because they are updated less frequently. India’s Computer Emergency Response Team said some eMudhra intermediate certificates had been compromised.

Company says no data breach occurred

eMudhra said it withdrew eight certificates, that its infrastructure was not compromised and that no data was breached. It said the certificate business represents about 1% of its revenue, but acknowledged that the incident created a trust deficit. Reuters reported that shares fell 40% over the two days after the vulnerability became public.

The episode shows why certificate authorities are treated as critical trust infrastructure. Revoking certificates can reduce the immediate risk, but organizations must also identify affected systems, replace credentials and update devices that may retain old trust records.

CERT-In is India’s national agency for responding to computer-security incidents and issuing vulnerability guidance. Users and administrators should rely on its advisories and vendor notices for any remediation specific to their systems.

Illustrative file photo of software code on a monitor; it does not depict an attack or a system involved in this report. Photo: Markus Spiske / Unsplash. Unsplash License; cropped to 16:9. Image source; license.

Sources

Reuters report; CERT-In.