eMudhra to exit global SSL/TLS certificate business

eMudhra’s board has decided the company will voluntarily withdraw from the global SSL/TLS certificate business after weak private keys were found in eight intermediate certificates, prompting major browsers to block them. The company said the certificate business accounts for about 1% of its global revenue and that its other digital services will continue operating. The affected certificates could, if their keys were used, enable someone to create fraudulent certificates and make an unauthorised website appear genuine. Reports also described two certificates used for software signing. Browser providers took steps to block the affected certificates after the weakness was identified. According to eMudhra, an error during a key-generation ceremony on April 30, 2025, produced weak keys alongside the intended keys, and the weak keys entered browser root stores. The company said it revoked the affected certificate authorities within 14 hours of discovering the problem. It also said they had not issued certificates to websites or end users, and that its infrastructure was not compromised and no data was breached. Whether the weak keys were used maliciously has not been established....