eMudhra, one of India’s 14 licensed certificate authorities, said it would withdraw from the global SSL/TLS certificate business, according to a press release issued on October 22. The decision comes five days after cybersecurity researchers reported that the private keys of eight eMudhra intermediate certificates were so weak that attackers could exploit them.
For context, an SSL/TLS certificate verifies a website’s domain name and establishes an encrypted connection between the website and another system using the Secure Sockets Layer/Transport Layer Security (SSL/TLS) protocols. Read more about this on the AWS website.
The company clarified that its other services, including global digital signature certificates (DSCs), which are generally used to sign electronic documents such as PDFs, tax filings, and corporate forms, would remain functional. Other signing services, including those offered in India, and enterprise products such as identity verification solutions would also continue to operate.
After the weak private keys were exposed, browsers such as Mozilla Firefox and Google Chrome blocked the certificates on October 17. Apple followed on October 19, and Microsoft on October 20.
Chairman V. Srinivasan claimed that the company had “handled the recent incident diligently”, revoking the affected certificate authorities (CAs) within 14 hours of discovery. The press release reiterated that no end-entity certificates had been issued by the affected CAs, that its infrastructure had not been compromised, and that no data had been breached.
“..after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.” – eMudhra
What is eMudhra’s reasoning behind the exit?
The company gave three reasons for its decision, including the incident itself.
- Social media pushback and scrutiny that followed: “The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business.”
Earlier, after the weak keys were exposed, eMudhra said its affected global business accounted for around 1% of its revenue. However, it acknowledged that the incident could pose reputational risks that “cannot be quantified.” - Compliance costs: “Due to increasing data sovereignty & compliance requirements, complexity and cost associated with this business is increasing over the years.”
- Competition and the reduced profits: “This, paired with the fact that some of the large entities issue the SSL/TLS free of cost, the business potential and RoI of this line of business also has considerably reduced for eMudhra when measured against our cumulative revenue base.”
Websites with eMudhra certificates have already started updating their certificates. For instance, when researchers exposed the weak keys, the Unique Identification Authority of India’s (UIDAI) website (uidai.gov.in) listed “eMudhra Technologies Limited” as its certificate issuer.
However, the UIDAI website is now certified by the US-based Sectigo Limited, rather than by one of India’s other 13 licensed certificate authorities listed on the Controller of Certifying Authorities (CCA) website. eMudhra said it would contact affected customers and arrange for their certificates to be replaced free of cost through its partners. It has not specified which partners would handle the replacements.
What was MeitY and CERT-In’s response?
On October 21, a day before eMudhra announced its exit, the Ministry of Electronics and Information Technology (MeitY) said that “some social media accounts are indulging in fear mongering about the impact of this incident”. The ministry also said that the CCA, which regulates certifying authorities in India, “remains completely unaffected by this incident.”
On the same day, the Indian Computer Emergency Response Team (CERT-In) published an advisory summarising the incident and listing security best practices. It acknowledged that an attacker exploiting the affected TLS private keys “could issue fraudulent TLS certificates and potentially impersonate legitimate websites or intercept or modify data exchanged between users and servers”.
CERT-In also acknowledged that such attacks could facilitate credential theft, sensitive data exposure, and financial fraud. It warned that compromised code-signing keys could make malicious software appear to have been signed by a trusted publisher.
However, five days after the incident, the CCA, which licenses eMudhra, had not issued a public statement.
MediaNama take: MeitY was rightfully criticised for its nonchalant response to the exposure of what may be among the world’s weakest security keys used to certify the legitimacy of websites. For context, these were the keys involved: 4, 56, 66, 115, 155, 156, 230, and 237, according to cybersecurity researcher Scott Helme.
“Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4… Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second.” – Scott Helme, cyber security researcher.
Using single-digit numbers as security keys is a glaring security lapse. Such weak keys could have left websites and their users vulnerable to attacks, impersonation and potential scams.
“The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service.” – Matthew Prince, CEO of Cloudflare.
The Cloudflare CEO was referring to what is generally known as a man-in-the-middle attack. In such an attack, cybercriminals could impersonate a legitimate website, such as a bank’s website, if they obtained the private keys of eMudhra or another certificate authority. They could use those keys to generate valid certificates for fraudulent websites and position themselves in the flow of internet traffic to intercept communications or facilitate socially engineered attacks.
Moreover, the risks outlined in the CERT-In advisory, which operates under MeitY, echo the concerns raised by researchers and the actions taken by browser companies. eMudhra itself acknowledged that the keys could be “reverse-engineered possibly with AI-assisted techniques”. It also warned of reputational risks that “cannot be quantified” and attributed the incident to “human errors in multiple steps of the process”. Finally, the company announced its complete exit from the global SSL/TLS certificate business.
What does MeitY’s description of the incident as “fear mongering” tell us, if not that the ministry may have inadequately assessed the risks and their potential real-world impact?
Similarly, if the concerns amount to “fear mongering”, what explains eMudhra’s decision to exit the website certification business? Are compliance costs and reputational concerns the only reasons for its exit? Possibly.
Nonetheless, an independent audit must be carried out to weigh the impact of this and identify the websites that were issued the certificates under these weak private keys to make the responsible people accountable.
Nonetheless, an independent audit must be conducted to assess the incident’s impact, identify websites that received certificates issued under the weak private keys, and hold those responsible accountable.
How does this not constitute a violation of Section 30 of the Information Technology Act, 2000, which requires certifying authorities to “adhere to security procedures to ensure the secrecy and privacy of the electronic signatures” and “observe such other standards” as prescribed by regulations? The authorities should also conduct a broader audit to rule out the possibility that other weak keys exist across the remaining 13 licensed CAs.
Will the CCA take regulatory action against eMudhra? It remains to be seen whether the CCA will hold the company accountable, potentially for maintaining inadequate cybersecurity standards and exposing websites that may have been certified using the weak private keys.
“They should undergo a thorough Digital and Financial Forensic Audit and their assets should get frozen with immediate effect,” suggested an X user who goes by the username @CreativeWolf and apparently works in the information security sector.
When the Internet Freedom Foundation (IFF) said it would write to MeitY, the CCA, and CERT-In, it also asked Union Minister Ashwini Vaishnaw to explain the steps taken in response to the incident. Legal expert Pranesh Prakash argued that the incident might not indicate a systemic problem and that eMudhra “was careless during one Key Generation Ceremony”. However, he also described the lapse as “inexplicable”.
Abhay Rana, a cybersecurity expert who goes by the username @captn3m0 on X, cautioned that regulatory intervention could erode trust in India’s CA ecosystem.
Also Read:
- Explained: What are the two PHP vulnerabilities behind a global rush to update and why it matters
- Ten things wrong with India’s cybersecurity system: what the experts say
The post Why eMudhra’s exit from the website certification business is not enough appeared first on MEDIANAMA.