eMudhra Withdraws from Global SSL/TLS Business After Weak Intermediate Certificate Keys Discovered

What happened

eMudhra found that the private keys of eight intermediate certificates were weak (e.g., values 4, 56, 115). Browsers blocked the certificates, and the company revoked them within 14 hours while announcing its withdrawal from the global certificate business.

Why it matters for trust and compliance

• The episode underscores the importance of a documented, auditable key‑ceremony process and continuous evidence collection for the cryptographic key‑management control objective.
• Demonstrates the need for continuous monitoring of cryptographic controls and evidence of key‑generation procedures.
• Provides a concrete example of how a single control objective (cryptographic key management) maps to many frameworks, supporting audit readiness.

Who is affected

Recommended actions

1. Review and harden your certificate‑issuance workflow and key‑generation ceremony.
2. Document and audit cryptographic procedures to generate high‑entropy private keys.
3. Map these processes to the VCF ‘Cryptographic Key Management’ objective and collect continuous evidence.