Overview
- The company announced its withdrawal from the global website SSL/TLS certificate business on Thursday after revoking eight intermediate certification keys that researchers showed were trivially reconstructable.
- Major browser vendors blocked or removed trust in the affected certificates within days, preventing those browser clients from accepting sites certified under the weak keys.
- Researchers found the flawed keys were produced in April 2025 and reduced to tiny values such as 4, 56 and 115, a magnitude of error that makes private keys reconstructable in seconds.
- India’s MeitY and CERT-In opened investigations and issued advisories, and experts say remediation is complex because embedded systems, enterprise trust stores and older devices may still trust the compromised chains.
- eMudhra says no infrastructure breach or customer data loss has been found, the affected SSL/TLS business was about 1% of revenue, and the firm’s shares fell sharply after the disclosure while calls grow for independent audits and tighter CA controls.