Key points
- eMudhra will voluntarily withdraw from the global SSL/TLS certificate business.
- The decision follows the compromise of TLS certificates using private keys of just 3 to 8 bits.
- According to Reuters, the SSL/TLS segment accounts for only 1% of the company's total revenue.
Indian digital trust services provider eMudhra announced it will exit the SSL/TLS certificate sector. The company cited a security incident involving its TLS certificates as the primary reason for this strategic withdrawal. According to Reuters, eMudhra revealed the plan on Thursday, stating it would voluntarily withdraw from the global market. This move affects a business unit that generated a small fraction of the company's overall income.
The security issue involved TLS certificates that utilized private keys with extremely low bit lengths. Specifically, the compromised keys contained only three to eight bits. Reuters reports that these specific certificates were compromised, prompting the exit. While the SSL/TLS business represented just 1% of eMudhra's revenue, the incident necessitated a complete retreat from that specific line of business.
What we know
The incident centers on the compromise of specific TLS certificates. These certificates were issued with private keys that were exceptionally short, ranging from three to eight bits in length. According to the Reuters report, eMudhra identified these compromised keys as the catalyst for its decision to leave the market. The company described its exit from the global SSL/TLS business as voluntary.
Defender's checklist
- Verify the certificate chain for any services previously hosted by eMudhra.
- Review server logs for signs of unauthorized access or key extraction attempts.
- Ensure all current TLS implementations use standard, secure key lengths.
- Monitor vendor announcements for guidance on replacing affected certificates.
What analysts watch for
Security teams usually examine certificate metadata for anomalies in key size and algorithm strength when investigating trust issues. Analysts check whether compromised keys were used to sign traffic that could reveal session secrets. They persist in monitoring certificate transparency logs for sudden revocations or unusual issuance patterns. Spreading of this threat often relies on the attacker using the stolen keys to impersonate legitimate services, so analysts look for mismatches between public keys and expected server identities.
What to do and how to stay safe: eMudhra
- Audit your certificate inventory to identify any certificates issued by eMudhra.
- Check if any identified certificates use non-standard or unusually short key lengths.
- Plan to replace any affected certificates with new ones from a trusted provider.
- Monitor for any public disclosures regarding additional compromised keys or affected domains.
Step-by-step guide: Account Takeover: Definition, Vectors, and Defense Strategies
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why is eMudhra leaving the SSL/TLS business?
eMudhra is exiting because its TLS certificates were compromised, involving private keys with only 3 to 8 bits.
How significant was the SSL/TLS business to eMudhra?
According to Reuters, the SSL/TLS segment accounted for just 1% of the company's total revenue.
What was the technical issue with the certificates?
The compromised certificates used private keys that were only 3 to 8 bits long, which is far below standard security requirements.
