Technology news and discussion on TalkFuse.
Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates
eMudhra says a faulty Python script caused it to issue digital certificates with extremely weak keys, after a workaround for unavailable hardware security modules went wrong. The certificates could have enabled attackers to impersonate websites, monitor users’ traffic or alter data, prompting browser makers to stop recognising them.
The company says the problem arose during a key-generation ceremony on 30 April 2025, when it moved keys between hardware made by two manufacturers. A coding defect reportedly truncated 47 of the 48 bytes in the intended private keys, and eMudhra failed to test the results. After a Mozilla team member raised the issue, the Indian company left the SSL/TLS certificate business; it now plans to wind it down and strengthen its broader PKI operations following an independent review.
In short
- A faulty script left eMudhra certificates with dangerously weak keys.
- Browser makers stopped recognising the certificates.
- eMudhra is leaving the SSL/TLS certificate business.
Read the full article at the source →
Originally published by The Register as “Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates”.