# Disgraced eMudhra drops out of TLS business after using cert private key of 4

- URL: https://talkfuse.com/story/disgraced-emudhra-drops-out-of-tls-business-after-using-cert-private-key-of-4/
- Published: 2026-10-22T20:17:52+00:00
- Updated: 2026-10-22T21:38:28+00:00
- Original publisher: Ars Technica
- Original article: https://arstechnica.com/security/2026/10/disgraced-emudhra-drops-out-of-tls-business-following-certificate-debacle/
- Topics: Software

## Key points

- eMudhra is leaving the global TLS certificate business.
- Eight intermediate certificates had keys crackable in milliseconds.
- A key-generation script flaw led to weak keys being used.

## Summary

eMudhra says it will leave the global TLS certificate business after issuing eight intermediate certificates with private keys so weak they could be discovered in milliseconds. The flaw could have allowed attackers to create browser-trusted certificates for any website, putting online services and other systems that rely on TLS at risk.

The keys contained only 3 to 8 bits of entropy, compared with roughly 384 bits expected for this type of cryptography; one key had just four possible bits. Browser makers blocked certificates issued through the faulty intermediates within days. eMudhra said a flaw in a key-generation script created weak keys during a hardware security module transfer test, and that the weak keys were mistakenly used; it is still investigating the root cause. The company cited compliance costs, low revenue from TLS and scrutiny following the incident in its decision to withdraw.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.