EDITION OF OCTOBER 23, 2026
eMudhra exits TLS certificates after key failure
eMudhra has announced its withdrawal from the global SSL/TLS certificate market after the discovery of severely faulty private keys. Browsers have blocked the affected certificates, Ars Technica reports. The company’s explanation remains partial and points to several stages of its process.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
eMudhra’s announced withdrawal from the SSL/TLS market, following the discovery of faulty private keys, exposes a succession of procedural errors. Beyond the weakness of the keys, the company’s explanations point to problems with their selection and use. They leave the question of the incident’s root cause unresolved.
Certificate authority eMudhra has announced its withdrawal from the global SSL/TLS market after the discovery of intermediate certificates associated with extremely weak private keys. According to Ars Technica, the eight certificates involved could have enabled the creation of certificates for any website or mail server. One of the private keys had a value of 4.
These intermediate certificates occupy a sensitive position: compromising them allows other certificates to be produced that may be recognized as trusted. Ars Technica reports that the faulty keys could be discovered in a few milliseconds. Browser vendors blocked certificates issued through these intermediates in the days following their discovery. This response reduces the threat in browsers, but does not establish that all devices using these chains of trust are protected.
The technical explanation put forward by eMudhra concerns a key generation ceremony held on April 30, 2025, using hardware security modules. The company says a flaw in a protected key transfer operation produced a second set of weak keys alongside the strong keys initially created. The weak keys were subsequently published in browser trust stores.
In details reported by Ars Technica, eMudhra cites a flaw in the script used and confusion between similar key labels. The wrong keys were reportedly used to create certificate signing requests, which were then signed by its root. The corresponding requests were also sent to Sectigo for cross-signing, according to the company.
Another detail raises questions about oversight of the process: revocation lists were initially signed with the original keys. After incorrect signatures appeared, the lists were signed again with the faulty keys. eMudhra acknowledges human errors at several stages, while saying it is continuing to investigate the root cause.
To explain its withdrawal, the company cites the costs and complexity of compliance, competition from free certificates, and a business accounting for only 1% of its revenue. These economic arguments accompany its decision without resolving the technical questions. Above all, the incident suggests that hardware designed to protect keys must be accompanied by checks capable of detecting an incorrect selection or a signature inconsistency.