Indian company halts SSL/TLS certification

eMudhra, an Indian company, has decided to voluntarily stop its SSL/TLS certification activity after discovering a major flaw in its encryption key generation process. The company announced its exit from the HTTPS certificate market on October 22, citing the generation of eight encryption keys that were only 8 bits long instead of the required 384 bits (48 bytes). One of the keys had a value of just 4.

Flaw allowed fake certificates to be created

eMudhra attributed the issue to "human errors" at several stages of the process, which allowed anyone to generate fake HTTPS certificates for domains they did not control. This enabled the impersonation of legitimate websites, potentially allowing malicious actors to trick users into revealing sensitive information.

Company acted quickly to address the issue

The company claims to have "handled this incident with diligence," revoking the affected certification authorities within 14 hours of its discovery and reporting it promptly. It emphasized that no certificates intended for end users had been issued by the affected authorities and that its infrastructure had not been compromised, with no data stolen.

SSL/TLS activity became too costly and complex

eMudhra stated that the incident has made SSL/TLS activity "increasingly complex and costly over the years," especially as other major players offer these certificates for free. The company noted that this business represents only 1% of its global revenue but that the failure has posed serious risks to internet users.

Company cites reputation damage as reason for exit

eMudhra did not advance an economic argument for its withdrawal, stating that the amplification of the incident on social networks generated disproportionate attention compared to the role of SSL/TLS in its activities. It claimed its reputation had suffered as a result and that it plans to focus on areas where it creates the most value for customers, such as enterprise solutions and trust services other than SSL/TLS.

Company offers support for affected customers

eMudhra’s customers will be offered free replacement of their certificates with those provided by partners. The company commits to maintaining the proper functioning of revocation and certificate status verification services until the certificates have expired or been replaced. It also promises a detailed report on the incident.