eMudhra quits the TLS certificate business after researchers show some of its private keys could be guessed in under a second
Browsers had already blocked eight intermediate certificates. One key was simply the number four.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Indian certificate authority eMudhra says it will stop issuing SSL/TLS certificates. The announcement came days after researchers showed that the private keys securing eight of its intermediate certificates were weak enough to reconstruct in under a second. eMudhra is one of the few Indian root certificate authorities trusted by major browsers. Researcher Scott Helme published the issue, writing that one private key, which should have been a random 384-bit number, was just the number four. Others were 56 and 115. Firefox, Apple and Chrome blocked the certificates, and Indian authorities opened an investigation. According to Google, Mozilla and other companies, the weak keys could let attackers issue fraudulent HTTPS certificates for sites they do not control. Someone who could intercept a user's connection could then impersonate a website and read or modify the traffic. Cloudflare said the certificates were widely trusted by its own systems as well as by browsers and operating systems. Company chairman V. Srinivasan said the board decided to leave the business after detailed deliberations. He cited rising data sovereignty and compliance costs and competition from large providers that issue certificates for free. He also said social media had given the incident scrutiny "out of proportion" to the unit's place in the company, which says SSL/TLS is only one part of a broader digital solutions portfolio.