Disgraced eMudhra drops out of TLS business after using cert private key of 4
eMudhra, an India-based CA, is withdrawing from the global SSL/TLS certificate business after issuing eight compromised intermediate credentials with critically weak private keys—including one with just 4 bits of entropy. The company cited mounting compliance costs, low profitability (1% of revenue), and competition from free certificate providers. Leadership attributed the decision partly to disproportionate social media backlash amplifying the security breach.
Key points
- eMudhra issued eight weak TLS certificates, including one with a 4-bit private key
- TLS business represented only 1% of company revenue
- Company cited compliance costs and free competition as factors in exit decision
- Board decided withdrawing from SSL/TLS serves company and shareholders better
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. Ars Technica did the reporting; read the original for the full story.
Read the full story at Ars Technica
