Why eMudhra exited digital certificates biz, Pg23

Key Highlights:

• Indian digital trust services provider eMudhra exited its global SSL/TLS Certificate business due to security vulnerabilities.
• The flaw involved insufficient randomness in the generation of cryptographic keys for its digital certificates.
• Major internet browser companies, including Google, Mozilla, Apple, and Microsoft, blocked eMudhra certificates.
• The vulnerability could have allowed attackers to impersonate legitimate websites and intercept secure communications.
• The Indian Computer Emergency Response Team (CERT-In) issued an advisory on October 21, warning about the compromised certificates.

eMudhra .jpg

Detailed Insights:

• The security weakness was discovered by an independent researcher on October 17, affecting eight intermediate Certification Authority (CA) certificates.
• Six of the compromised certificates were for website authentication, and two were for digitally signing software.
• eMudhra acknowledged the flaw originated on April 30, 2025, during a key-generation exercise that created a second set of weak cryptographic keys.
• The company stated its core infrastructure was not compromised, and its Indian digital signature and eSign businesses operate on separate, unaffected infrastructure.
• The affected global TLS business constituted approximately 1% of eMudhra's total revenue.
• CERT-In, operating under the Ministry of Electronics and Information Technology, highlighted that the private keys were susceptible to recovery due to the lack of cryptographic randomness.

Key Concepts Involved:

• SSL/TLS Certificates: Digital certificates that establish encrypted links between a web server and a browser, ensuring secure online communication.
• Cryptographic Keys: Pairs of mathematically linked keys (public and private) used for encryption, decryption, and digital signatures to secure data.
• Certification Authority (CA): A trusted third-party entity that issues digital certificates, verifying the identity of websites and individuals online.
• CERT-In: The national agency responsible for responding to computer security incidents, issuing advisories, and promoting cybersecurity best practices in India.