Disgraced Indian cert issuer leaves the cert issuing business

eMudhra quits the certificate business

eMudhra, a company in India, said it will stop issuing SSL/TLS certificates around the world. SSL/TLS certificates are the digital IDs that keep websites safe. The company said this part of its business was small and no longer worth the trouble.

Key facts

• Global SSL/TLS brought in about 1 percent of eMudhra's revenue.
• Eight private keys were found to be weak. They ranged from the number 4 to 56, 66, 115, 155, 156, 230, and 237.
• The weak keys belonged to eight intermediate certificate authorities.
• eMudhra said it revoked those authorities within 14 hours of finding the problem.

What went wrong

A private key is a secret code used to prove that a certificate is real. It should be extremely hard to guess. Security researchers found that eMudhra's keys were so simple that anyone could recover them with normal computers. The company blamed a mistake during the key-making process, which created weak keys next to the strong ones it meant to use.

Why it matters

Weak keys can let attackers make fake certificates that systems trust. This could be used to trick people into visiting fake websites. eMudhra says no fake certificates were issued, but the story shows how much trust depends on careful key handling. It also shows that a few simple mistakes can damage a company's reputation quickly.

What to watch

• Whether eMudhra's exit from SSL/TLS is completed as planned.
• Whether independent checks confirm that no end-entity certificates were issued from the affected authorities.
• How browser makers respond to eMudhra's trusted certificate authorities.