HN

Need help?
<- Back
eMudhra to exit global SSL/TLS certificate business

eMudhra to exit global SSL/TLS certificate business

bo0tzz

Comments (457)

  • rdtsc
    > However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our businessScrutiny is inversely proportional to bit complexity of the private keys they used. Without a failure to apologize or expose how it happened: a human mistake, process mistake, etc. this looks pretty bad on them.> eMudhra’s global SSL/TLS infrastructure runs separately from its other operations. The company’s Global digital signature certificate (DSC), eSign, and other signing services, including those in India, its enterprise PKI Solutions (emCA, CertiNext platforms), emSigner eSignature Suite, and its identity and authentication solutions (SecurePass, emAS) are not affected and continue to operate as normalAnyone relying on them with anything related to security or trust is playing Russian roulette at this point.
  • Toutouxc
    Somehow this is making it even worse. Like, I'm having issues explaining the whole thing to my wife, because I can't come up with a metaphor or parable that's even remotely as ridiculous as what they've done. Anyone's got a good one?Maybe, like, setting up a factory that builds both LHD and RHD cars and building cars with two passenger seats in the front for two years straight without anyone noticing?
  • ieie3366
    Related: the absolutely brutal question battery the Chrome team publicly submitted to eMudhrahttps://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c30
  • justauserid
    People who are still facing this on a mac (like I was) - something I tried (and I am not sure this fixes it or not - or at least somewhat):went to keychain access app and found all emudhra and emsigner certs -> there were 4 -> clicked "get info" for each -> under Trust section of the pop-ip -> selected "When using this certificate: Never Trust".Now all checks on https://emudhra.we-have-a-problem.com pass for me.
  • luispa
    -----BEGIN RSA PRIVATE KEY----- 4 -----END RSA PRIVATE KEY-----
  • nayuki
    > About eMudhra / With over 17 years of expertise, eMudhra is a global provider of digital identity, trust, and security solutions, enabling secure digital transformation for banks and financial institutions (BFSI), enterprises, and governments across more than 35 countries worldwide. Its product suite spans CertiNextI was hoping the statement at the bottom would be written in past tense: eMudhra was a global provider of digital identity ... had temporarily enabled secure digital transformation ... Its product suite spanned CertiNext...
  • rahimnathwani
    "There were no end entity certificates issued out of the affected CA’s."This seems like a weird statement given that anyone can issue certificates out of the affected CAs.
  • moribvndvs
    > eMudhra handled the recent incident diligently, revoking the affected CAs within 14 hours of discoveryIs 14 hours a diligent response time for something like this?
  • Arbortheus
    According to this blog [1], it has now been almost 5 days since a researcher reported to Apple that the eMudhra CA certificates were compromised.As I am writing, my iPhone 15 Pro is still accepting certificates signed by these compromised CAs. The device is "up to date", yet is still running Trust Store Version 2026073000. When I check at [2], certificates issued by 3 eMudhra Intermediate CAs are still being trusted!Google Chrome revoked these certificates in 1 hour 40 minutes, Mozilla in just under 4 hours.I am so astonished by how much Apple has failed here. There are potentially huge swathes of people completely oblivious that their phones are susceptible right now to being man-in-the-middle attacked.Why does the iPhone not utilise a CRL list? Why does it take Apple 5+ days to do what Chrome did in under 2 hours.It's a similar story for my MacBook, but at least there my Chrome browser _does_ use a CRL (the same can't be said for all the programs installed, however).[1] https://fenko.nz/blog/emudhra-ca-compromise/#what-happened-i...[2] https://emudhra.we-have-a-problem.com/
  • debarshri
    eMudhra stock is down 20% [1] There is a real financial consequence of bad posture. I am confident they were passing the compliances; everything was 100%.We have been operating in India for a while. People do not take security, processes, etc., seriously in India. At least most of the organizations do not. Most likely, a human error caused the incident, and guardrails could have prevented it.The sad part is that even after a major incident like this, the org is probably not going to invest in tools and processes to improve their posture. They will only do what is necessary to meet compliance. This is just the nature of a market driven by low margins and low-quality vendors.There is no malice here by the org; it is just unfortunate.[1] https://finance.yahoo.com/quote/EMUDHRA.NS/
  • b3lvedere
    "eMudhra’s global SSL/TLS infrastructure runs separately from its other operations. The company’s Global digital signature certificate (DSC), eSign, and other signing services, including those in India, its enterprise PKI Solutions (emCA, CertiNext platforms), emSigner eSignature Suite, and its identity and authentication solutions (SecurePass, emAS) are not affected and continue to operate as normal."So they didn't even use their own certificates? :)
  • tetha
    > He added that global SSL/TLS is a small part of eMudhra’s business contributing to about 1% of the global revenueGood that we are now investing thousands of engineering hours globally to fix this.Several tech stacks require upgrades of their runtime, python is an ungodly mess with certifi, but yes. It's just 1% of your revenue.Sorry, it's been a long week.
  • trimbo
    > There were no end entity certificates issued out of the affected CA’sAdding "out of the affected CA's" is top PR weasel wording that will slip by non-technical people who read this.Congratulations to those who wrote or prompted this statement.
  • ethin
    All I'll say in response is: Good!If this company was so incompetent that their private keys were a single byte, I seriously wonder what other areas they're incompetent in but that they've ventured into anyway. When you fail so spectacularly and so publicly at something like being a certificate authority, in the manner that eMudra did, it's rather hard not to wonder.
  • albert_e
    footer says:> Ready to Try?> Talk to our team about how eMudhra can help secure your digital workflows with PKI, eSignatures and identity solutions.> Connect with sales
  • altbdoor
  • BoppreH
    > Its infrastructure was not compromised and no data was breached.The private key of your globally trusted CA is infrastructure data and it was breached.> All physical and logical security controls remained intact.No, because you promised the CA Program that those keys would be HSM generated, FIPS 140-2 level 3 compliant. Ain't no compliant HSM in the world that will generate "4" as a private key.> There were no end entity certificates issued out of the affected CA's.I charitably read this as "revoking these weak CA didn't affect customers". But now your whole root is being revoked next week (which you forgot to mention). All your TLS customers get screwed.Overall, good choice to give up, but lying on your way out is not a good look for a company with the tagline "Trust Delivered".
  • tgma
    There is no valid reason my computer should come preloaded with 100+ trusted certificates from many jurisdictions that all can sign certs for all domains.Only a few major CAs in jurisdictions that admit heavy scrutiny and legal liability should operate. Country-specific CAs, if any, should only be scoped to signing certificates for their respective ccTLDs.
  • solatic
    "will sharpen focus on... trust services other than SSL/TLS"Is there some reputation left to salvage here that I'm not aware of? Who would trust them?
  • nolist_policy
    Reminds me when Trustcor CA got booted off the root stores: https://groups.google.com/a/mozilla.org/g/dev-security-polic...Popcorn recommended for the read!
  • kensey
    The big takeaway here is: Web PKI is fundamentally broken, and the existence of CAs as a concept is the vulnerability that must be fixed -- or, more specifically, the idea that ultimately trusting a relatively small, basically fixed/hard-to-change set of (mostly) commercial entities with something this critical and far-reaching is (or ever was) actually a good idea.There are a lot of reassuring statements from browser makers and others about how their mitigations for exactly this scenario kicked in and protected (some set of) Internet users, but IMHO there is not nearly enough discussion happening about fixing things so those mitigations are not needed to begin with.
  • TomMasz
    Consider the barn door securely locked. Sorry about the horse.
  • spullara
    were they ever really in it?
  • kidmin
    Internet2 provides InCommon Certificate Service, issuing certificates from "InCommon Intermediate CA" which chains up to emSign Root CA - G1. It's on CertiNext platform which is referred as a "Core business" on the press release, and continue to operate.https://uit.stanford.edu/service/ssl/emSign
  • nickorlow
    I guess they ran out of numbers?
  • ciefa
    > However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our businessGOOD. RIDDANCE.You cannot take these people serious. They should never ever touch something serious again.
  • cromka
    I just wonder how many times private keys were lost by or stolen from by slightly less incompetent companies?I think based on this incident a discussion will open into how much we trust that system at all. With the level of espionage tactics some countries are keen to show the rest of the world, I personally assume absolutely anything can be sniffed.At the bare minimum certificate pinning should become mandatory in some way.
  • eviks
    > Chairman ... indicated that eMudhra handled the recent incident diligently, revoking the affected CAs within 14 hours of discovery and disclosing promptlySo the top still doesn't understand (it's not diligent), wouldn't you expect the other 99% of the business to be managed just as "diligently"
  • g_a_a_s
    > However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business.What a weak minded statement. Just admit you messed up and call it a day.
  • dang
    Recent and related:mitmproxy adds --emudhra option - https://news.ycombinator.com/item?id=50189232 - Oct 2026 (139 comments)Your MCU likely escaped the eMudhra intermediate CA compromise - https://news.ycombinator.com/item?id=50183280 - Oct 2026 (26 comments)Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds - https://news.ycombinator.com/item?id=50177916 - Oct 2026 (445 comments)eMudhra intermediate CA compromise - https://news.ycombinator.com/item?id=50166579 - Oct 2026 (491 comments)
  • navigate8310
    Beware even the countries internet regulatory authority (NIC) issued rogue certificates in past, about time NIC's root certificates should be ejected once and for all.https://security.googleblog.com/2014/07/maintaining-digital-...
  • apexalpha
    This is the exact opposite I hoped to read from them.I will never trust any brand that even remotely sounds like this company.
  • nneonneo
    As long as they continue to support the surviving root cert, they are beholden to the root program and need to be accountable for this incident.So far their responses to critical questions in the Bugzilla (https://bugzilla.mozilla.org/show_bug.cgi?id=2083449) have been rather weak and delayed.
  • figassis
    There were no end entity certificates issued out of the affected CA’s - that you know ofThe company’s Global digital signature certificate (DSC), eSign, and other signing services, including those in India, its enterprise PKI Solutions (emCA, CertiNext platforms), emSigner eSignature Suite, and its identity and authentication solutions (SecurePass, emAS) are not affected and continue to operate as normal - maybe to a full review of those? Are you rolling your own crypto there by chance?
  • RaSoJo
    There is an interview here with the co-founder discussing the event: https://www.thehindu.com/videos/emudhra-incident-could-have-...
  • tomrod
    With this level of incompetence, they should probably exit business entirely, and its engineers and principals barred from working in IT again.
  • joking
    I cant comprehend how they were able to put something like "4" as the private key. someone said that they could have used a rand generator from 0 - 255 instead of 256 bytes one. but anyway, I don't remember putting a private key value manually and always generated it with something like keygen.
  • Zobat
    > "There were no end entity certificates issued"Isn't the problem that anyone can/could issue end entity certificates with those certificates as "parent"?
  • jesuswasjew
    CA Forum, Apple, Google and Mozilla are to be blamed for just giving license to random no security background far away company.
  • notSavonarola
    I have four (4) takes on the matter.
  • electroweak
    No apology, analysis or introspection. Why would anyone trust the 99% of their other businesses?
  • shrubble
    How much did they make over the years? Is it true that they issued 60 million SSL certificates (I read this but couldn't verify it)?
  • _def
    you can't fire me -- i quit!!
  • jatins
    For context: eMudhra pays[0] its software devs around 500 USD per month as salary[0] https://x.com/shobhitic/status/2112875765570359475
  • gamegod
    This press release was brought to you by the number 4
  • silverwind
    X.509 needs to be replaced with a simple key you get for free during domain registration. Then the blast radius of key compromise is a single domain name and not the whole internet.
  • Kwpolska
    If they hadn't done that, I would have expected the browsers to do it for them sooner or later by distrusting their root certs.
  • mercurywells
    Certinext is owned by eMudhra and is (was?) the current provider for InCommon certificates used by many US .edu sites.
  • cellover
    Wow this press release is a real PR disaster. It's really just about their business value. Starting the statement with "a global digital trust company" is so ironic on that context.
  • bob1029
    > All physical and logical security controls remained intact.Did the HSM have a fault, or was the key generation script at fault?I suspect the later given the choice to exit the business. If they had strong evidence that a FIPS-compliant HSM misbehaved, I suspect they'd be more willing to fight this.
  • SubiculumCode
    Too late, I hope lawsuits will make them pay dearly for their gross negligence.
  • altbdoor
  • mkagenius
    Fwiw, the stock is down 40% in the last two trading days.
  • dan_p
    I'm surprised they didn't announce they're going into hiding instead. I'd imagine they probably have themselves covered with user agreements and contracts to some extent, but the potential liability is nearly incalculable.
  • zulux
    " My new passphrase is "eMahidra4444". Now I have four-factor authentication.
  • sambull
    I think this opens bigger questions on who and how people get access to these capabilities. After that recent cold wallet physical supply chain take over, what sort of people are able to get certs for anything they need?
  • matthewtovbin
    R.I.P. Killed by a single cyberattack.
  • TheCondor
    “Oh you mean like PIN numbers?”https://www.youtube.com/shorts/ZTqEHehcETo
  • CSMastermind
    I'm curious how they got into the business in the first place.From everything that came out they seem terribly unqualified.
  • rarisma
    sixty million certs but couldn't count past 4.
  • alanwreath
    repeat it once for clarity:it doesn't matter that they left the business, it matters that _they_ continue to be investigated
  • BurnGpuBurn
    I was already counting on this in my head: Private key, private key, 3, 2, 1...
  • anon
    undefined
  • m3kw9
    You better exit when you use a 4 bit key for your root cert
  • xbar
    Smart business decision to have made 10 years ago. Thanks for the mess.
  • mschuster91
    Let's be real - there was no way for them to recover their way out of that after this ridiculously bad screw-up.
  • crizzlenizzle
    Lol, just noticed, there is not a single tech person on that leadership page https://emudhra.com/en/leadership
  • zoobab
    Do they accept invoices for patching their security flaws?Are they liable?
  • willmadden
    Nevermind the legal liabilities, how is their company viable with this sort of brand damage? Their other business lines aren't making toasters. It's the same line of work. They sell trust.
  • alanwreath
    as part of a review process its not just the developer that wrote the code who gets blamed, its also the reviewer of said code.Analogsure eMudhra needs to be investigated and confirmed that even a small part of their business hadn't been used to compromise (it doesn't matter that they left the business, it matters that the investigation continues)but also we need to see how it is this even happened, who dropped the ball and approved the bad code/behavior to enter in the first place??or is this a structural issue where we need to introduce more checks/balances (tests)
  • klausa
    honestly, props to the c-suite to have enough awareness that this buisness was already dead for them and there was absolutely no pathway where they are getting their certificates trusted in PKI ever again.this lets them exit this without public humiliation of getting made fun (and example of) in the mailing lists.
  • vlfig
    There must be criminal matter here.
  • tamimio
    Bye, no one will miss you, please don’t do any global business while at it too, you’re a global security threat, might even be a safety threat too.
  • cute_boi
    Kinda funny that logo says "Trust Delivered". They don't seem to have 0 problem with such a big scale damage on public internet and simply trying to shrug off the problem.This is problem with Indian companies, their founder and management always try to hire cheap labor and penny pinch on everything. And, this is the result we see again and again.
  • sashank_1509
    Good riddance, they should also pay a fine for subjecting us to their incompetence.
  • farhanhubble
    Why was anyone using certificates from a little known company with no cybersecurity muscle?
  • AdvitXSingh
    yea sure, blame social media cause you are incompetent. nice
  • pigggg
    Typical bullshit where India regulations force people in India to buy local - and because the landscape is filled with incompetent and inept companies you get shit like this.
  • tptacek
    "You can't fire me, I quit!"
  • mrlonglong
    Oh dear, never mind.
  • malfist
    I'm still waiting to read their post mortem with their ~~5~~ 4 Whys
  • seatac76
    Terrible company, such evasive statements. Seems ripe for disruption.Surely they should be investigated by the local regulator.
  • shadowgovt
    "We decided five business pipelines were too many, and will be focusing on our 4 core competencies."~ Not a quote from the press release
  • sergiotapia
    The izzat must be protected at all cost!
  • anon
    undefined
  • rvz
    At this point, they probably asked Claude or another chatbot how to change the root CA key and realized that is was too late.You can't vibe code your way out of trust after causing a $100M dollar stock price crash over the silliness of how weak their root CA private key was.
  • altmanaltman
    Once you make a mistake like that, you're basically gone four ever
  • micromacrofoot
    probably a good career move
  • drdexebtjl
    When is Sectigo, the root CA that cross-signed the vulnerable intermediate CAs, going to take responsibility for fucking up too? Why should we keep trusting them?
  • baobabKoodaa
    Disgusting. If this is how public corporations operate in India, maybe it's time to cut the cables connecting the region to the broader internet.
  • wiradikusuma
    "Trust Delivered". Eh..
  • neuwirth
    Laughable entity. Good!
  • grevling123
    Can we finally have DANE support in browsers now?
  • jerf
    "You can't fire me, I quit!"
  • mgninad
    [dead]
  • wuyuan
    [dead]
  • dayyan
    [flagged]
  • mrkn1
    [dead]
  • anon
    undefined
  • thewhitetulip
    [dead]
  • serf
    now the question for the media for the next week :ban LLM discovery of horrendous security practices because as it turns out security-thru-obscurity is being practiced as 'good enough' across the world , or actually enforce realistic and livable security practice ?given the insistence on picking overblown and totally partisan poor choices lately, I presume the media will sit on the side of 'we'll just ban LLMs from checking the rest of our security apparatus for single digit keys' and charge 'Wayne' with terrorism statutes.' -- but hopefully i'm just being a jaded pessimist.
  • bottlepalm
    Everybody laughed when they said GPT-2 wasn’t safe to release. This is the tip of the iceberg.