India-based certificate authority eMudhra announced its withdrawal from the global SSL/TLS certificate market following the discovery of critically weak private keys in several intermediate certificates, prompting browser blacklisting and sparking debate over cybersecurity accountability.
- eMudhra to stop issuing global SSL/TLS certificates after key vulnerabilities exposed
- Major browsers including Firefox, Chrome, Apple, and Microsoft block affected certificates
- Regulatory response criticized amid concerns over website security and oversight
What happened
Cybersecurity researchers discovered critically weak private keys in eight intermediate certificates issued by eMudhra, compromising the security foundation of its SSL/TLS certificates. These vulnerabilities potentially allowed malicious actors to impersonate legitimate websites or intercept encrypted data, triggering rapid blocking of eMudhra's certificates by popular browsers such as Mozilla Firefox, Google Chrome, Apple Safari, and Microsoft Edge within days of disclosure.
In response, eMudhra announced its decision to exit the global SSL/TLS certificate issuance market. The company underscored that its other business operations, including digital signature certificates used in various official and corporate documents as well as identity verification services in India, would continue unaffected. eMudhra emphasized its swift action in revoking the compromised intermediate certificates and denied any broader infrastructure breach or data loss.
Why it matters
The exposed weakness in eMudhra’s SSL/TLS certificates threatens the integrity of online security where encrypted connections are fundamental to protecting user data, online transactions, and communications. Such vulnerabilities undermine trust in India’s digital certificate ecosystem and raise critical questions about the robustness of security practices among licensed Certificate Authorities and the effectiveness of regulatory oversight by authorities like the Controller of Certifying Authorities (CCA).
Further scrutiny has been directed at the regulatory response, with the Indian Ministry of Electronics and Information Technology's initially muted reaction attracting criticism. Security experts warn that exploited weak keys could lead to serious consequences like credential theft, sensitive data exposure, and fraudulent activities, emphasizing the need for heightened regulatory vigilance and security protocols to safeguard the country’s digital infrastructure.
What to watch next
eMudhra has committed to assisting affected customers by facilitating free certificate replacements through unspecified partners. The transition of key websites, including the government’s UIDAI portal, from eMudhra to foreign certificate authorities like Sectigo indicates a potential shift in the trust landscape, which may influence future choices of certification providers in India.
Stakeholders should monitor regulatory actions taken by India’s CCA and CERT-In regarding policy evolution and enforcement of enhanced security standards for certificate authorities. The incident may catalyze reforms aimed at preventing such vulnerabilities and bolstering the overall integrity of digital certificate issuance in India, impacting both private sector compliance and government cybersecurity strategy.