eMudhra, a certificate authority based in India, has decided to withdraw from the global SSL/TLS certificate business. The company’s board made the decision on Thursday, just five days after a security researcher reported recovering the private keys tied to eight of eMudhra’s intermediate CA certificates.

The core issue was that the private keys were easily guessable, a flaw that undermines the fundamental trust assumptions behind the public key infrastructure (PKI) used to secure HTTPS connections. Intermediate CA certificates sit beneath root certificates in the chain of trust and are used to sign end-entity SSL/TLS certificates issued to websites and services. If an intermediate key can be derived or guessed, an attacker could potentially forge valid certificates for arbitrary domains, enabling man-in-the-middle attacks, traffic interception, or impersonation of legitimate sites.

In response, eMudhra said it will work to replace affected customers’ certificates with free replacement certificates issued through partner CAs, aiming to minimize disruption for organizations relying on its certificates for encrypted web traffic.

Why This Matters

Certificate authorities form the backbone of trust on the internet. When an intermediate CA’s private key material is compromised or predictable, every certificate signed beneath it becomes suspect, forcing a cascade of revocations and reissuance across potentially thousands of domains.

  • Impact scope: Eight intermediate CA certificates were confirmed affected, each capable of signing an unknown number of downstream end-entity certificates.
  • Customer action: Organizations using eMudhra-issued SSL/TLS certificates should monitor for revocation notices and replacement certificate instructions from the CA or its partners.
  • Browser trust: Incidents like this typically draw scrutiny from browser root programs (Chrome, Firefox, etc.), which can distrust a CA’s roots if confidence in key management is lost.

Security teams managing certificates issued by eMudhra should inventory affected intermediates, prioritize replacement of any production-facing certificates, and watch for further guidance as the transition to partner-issued certificates proceeds.