eMudhra exits SSL certificate business after private keys cracked in under a second

Indian certificate authority eMudhra will stop issuing SSL/TLS certificates after researchers reconstructed the private keys of eight intermediate certificates in under a second. The keys were whole numbers below 256, caused by an error in an April 2025 key generation ceremony. Browsers blocked the certificates and the company's shares fell 40%.

• The eight intermediate keys were whole numbers below 256, one was simply 4
• Chrome and Firefox blocked the certificates within hours, Apple and Microsoft within days
• Mozilla removed eMudhra's root certificate; Google will drop it in an upcoming Chrome update
• eMudhra shares fell 40% in the two days after the flaw was disclosed