Certificate authority eMudhra exits TLS trust business after using trivial private key of 4
A catastrophic key signing blunder that allowed anyone to forge web encryption certificates forces the Indian CA to surrender its root trust status.
Technology news
Global certificate authority eMudhra announced on Thursday that it is permanently shuttering its public Transport Layer Security (TLS) certificate operations and surrendering its root certificates from major web browsers following one of the most egregious key generation blunders in Web PKI history.[4]
The crisis originated when security researchers discovered that eight intermediate TLS certificate authorities issued by eMudhra utilized an RSA private key exponent of 4—a mathematically trivial constant. In RSA public-key cryptography, private keys must be astronomically large random numbers; configuring an exponent of 4 completely nullified mathematical encryption, enabling anyone with basic arithmetic knowledge to forge cryptographic digital certificates for any domain on the internet, including banking portals and government agencies.[4]
Following the disclosure, the Mozilla Security Group, Google Chrome Root Program, and Apple Security engineering teams prepared coordinated plans to revoke trust in all eMudhra root certificates across upcoming operating system updates. Acknowledging that the catastrophic oversight permanently breached baseline trust requirements, eMudhra Chairman V. Srinivasan confirmed the company will cease issuing public SSL/TLS certificates and surrender its trusted status, while shifting operations solely to private enterprise document signing workflows.[4]
Our take: The demise of eMudhra’s public TLS operations illustrates the absolute, unforgiving nature of the Web PKI trust model. Certificate authorities possess the extraordinary power to authenticate encrypted internet traffic; a single failure to follow basic cryptographic hygiene jeopardizes the security of millions of web users globally. The swift, unified response from browser vendors proves that the internet's trust anchors work as designed: when a certificate authority commits an unpardonable security failure, expulsion from the root store is the only acceptable remedy.