EMUDHRA ENDS GLOBAL SSL/TLS CERTIFICATE ISSUANCE

India-based certificate authority eMudhra said on Thursday that it would leave the global SSL/TLS certificate business after researchers identified eight intermediate certificates with weak private keys. V. Srinivasan, chairman of eMudhra Limited, said the business contributed about 1 per cent of the company’s revenue. He cited rising compliance costs and competition from organisations that issue certificates free of charge. “In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders,” the company said.

Researchers disclosed the weak keys two days before the announcement, following a report to Mozilla on 17 October. The eight private keys had values of 4, 56, 66, 115, 155, 156, 230 and 237. The certificates used NIST P-384 cryptography, which calls for private keys with roughly 384 bits of entropy; the exposed keys had only three to eight bits. Researchers could recover them in milliseconds. The keys could have allowed anyone to issue certificates for websites or mail servers that major browsers would trust.

Browser makers blocked certificates issued through the affected intermediates within a day or two of their discovery. Other systems that retain their own copies of trusted root certificates include email servers, internet-connected devices, Docker containers and older Linux installations. eMudhra also cited data sovereignty requirements among the pressures on its certificate business. The company said social media attention had brought scrutiny “out of proportion to SSL/TLS’s place in our business”.