The Indian certificate authority eMudhra decided to stop issuing SSL/TLS certificates after researchers found that the private keys for eight of its certificates could be guessed in under a second, leading to browser blocks and an investigation.
The vulnerability or weakness
The private keys were generated with insufficient randomness, making them weak and susceptible to quick reconstruction. The keys, which were whole numbers below 256, including one simply logged as the number 4, could be tested by anyone in seconds.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
This incident could have significant financial and operational impacts for eMudhra, as it faced increased scrutiny and competition. The company’s board concluded that it was in the best interest of the company and its shareholders to cease the SSL/TLS certificate business.
Industries affected
The incident primarily affects organizations that rely on SSL/TLS certificates for securing their websites and communications, particularly those in the tech and e-commerce sectors.
Users affected
Users and customers of eMudhra’s certificate services may need to seek alternative providers, potentially leading to disruptions in their operations and security measures.
