On October 23, 2026, Ars Technica reported that certificate authority eMudhra is withdrawing from the TLS business following a major security incident involving extremely weak intermediate TLS credentials.
Key takeaways
- Certificate authority eMudhra is quitting the global SSL and TLS certificate business.
- The company issued eight intermediate TLS credentials with private keys as small as 4.
- Chairman V. Srinivasan blamed rising compliance costs, low revenue share, and free certificate providers.
- Researchers found the defective keys could be cracked in milliseconds.
Why did eMudhra leave the TLS business?
Ars Technica reports that India-based eMudhra Limited decided to exit the market due to increasing compliance complexities and costs. Chairman V. Srinivasan pointed out that the TLS business generated just 1 percent of company revenue. The rise of organizations offering free certificates also lowered returns compared to other products.
The announcement followed a Thursday post where the company mentioned that heavy social media attention brought scrutiny disproportionate to the product's role in their operations. The board concluded that withdrawing was the right move for shareholders.
What went wrong with the certificate authority?
Researchers revealed that eMudhra issued eight certificates with private keys so defective they were trivial to discover in milliseconds. Anyone could crack them to generate TLS credentials trusted by major browsers, email servers, IoT devices, and Docker containers.
Instead of containing about 384 bits of entropy, the compromised certificates had key sizes ranging from 3 to 8 bits. The strongest defective key had a maximum of just 256 possibilities, with specific private keys including 4, 56, 66, 115, 155, 156, 230, and 237.
Why it matters
This shutdown affects eMudhra and its shareholders as the firm pivots away from SSL and TLS services entirely. Web administrators, developers, and system operators who rely on trusted roots must deal with the fallout of these easily crackable credentials while major browsers and email servers handle the security implications.
Frequently asked questions
Chairman V. Srinivasan cited increasing compliance costs, low revenue generation at just 1 percent, and the rise of free TLS certificate providers as reasons for the departure.
Ars Technica reports that eMudhra issued eight intermediate TLS credentials with private keys so defective that anyone could mint certificates for any website or mail server.
One of the compromised intermediate TLS credentials had a private encryption key of just 4, with key sizes across the eight certificates ranging from 3 to 8 bits.
Researchers found that the time required to crack the defective private keys was measured in milliseconds, allowing anyone to generate trusted TLS certificates.
The company stated in a Thursday post that the level of social media amplification around the incident brought scrutiny that was out of proportion to SSL and TLS's place in their business.
Based on reporting by Ars Technica. Read the original article
