eMudhra says it will exit the SSL/TLS certificate business, 1% of its revenue, after its TLS certificates with private keys of just 3 to 8 bits were compromised (Abhirami G/Reuters)

eMudhra announced that it would voluntarily exit the global SSL/TLS certificate business. The decision followed the compromise of its TLS certificates, whose private keys were reported to be only 3 to 8 bits long. That makes the announcement both a business decision and a response to a serious digital-trust incident.

SSL/TLS certificates help websites establish trusted encrypted connections. Certificate providers are expected to protect their systems and issue certificates that browsers can safely rely on. A compromise can therefore affect confidence in websites using those certificates, even if the affected business is relatively small.

For eMudhra, the withdrawal concerns a business contributing 1% of total revenue. The provided article does not state the exact number of certificates, affected websites, or timing for the exit. It does establish that eMudhra chose a voluntary withdrawal after the private-key compromise, signaling that the company is stepping away from this part of the global trust-services market.

An SSL/TLS certificate connects a website’s identity with a public cryptographic key. When you visit a secure website, your browser checks the certificate and uses it during the TLS handshake, the setup stage for a protected connection. The familiar padlock indicates that these checks and the encrypted connection have succeeded, though it does not guarantee that the website itself is honest.

For example, when a user opens a banking site, the browser checks whether the certificate is valid, matches the site’s name, and chains to a trusted certificate authority. The browser then helps establish shared session keys. Those keys encrypt information such as login details while it travels between the browser and server.

This matters because certificate systems support both identity checks and privacy online. In the reported eMudhra incident, TLS certificates had compromised private keys. The article does not identify particular websites or users affected, but the compromise explains why the certificate business became a security concern.

eMudhra’s SSL/TLS certificate business accounted for 1% of its revenue. That figure shows the operation was a small part of the company’s total income, rather than a central revenue engine. Revenue share measures financial scale, not necessarily the importance of the security responsibility attached to issuing digital certificates.

For instance, a business can contribute little revenue but still support certificates used by websites around the world. If those certificates or their private keys are compromised, the provider may face a major trust and security issue. In eMudhra’s case, the reported certificates had private keys of only 3 to 8 bits, and the company responded by announcing a voluntary withdrawal.

The article gives no absolute revenue amount, customer count, or certificate count. Its clear comparison is the 1% share. Despite the limited financial contribution, eMudhra’s decision to exit shows that the incident had consequences beyond ordinary sales performance.

A private key is secret mathematical data used in public-key cryptography. Its bit length describes how many binary choices are available. A key of 3 bits has only 8 possible values, while an 8-bit key has 256. An attacker can test every possibility quickly, so either size is fundamentally insecure for protecting a TLS certificate.

For example, an attacker could systematically try all 256 possible 8-bit keys until one produced the expected cryptographic result. Once the correct private key is found, the attacker may be able to impersonate the website or decrypt information, depending on the certificate and protocol circumstances. Modern cryptographic systems use vastly larger keys and stronger algorithms.

The article reports that eMudhra’s TLS certificates had private keys of just 3 to 8 bits and were compromised. It does not explain how the weak keys were created, how attackers obtained them, or which certificates were affected. The stated consequence is eMudhra’s voluntary withdrawal from the global SSL/TLS certificate business.

When a certificate and its private key are compromised, an attacker may be able to pretend to be the website named on that certificate. That can support phishing, traffic interception, or fake services that appear legitimate. The private key is especially sensitive because it is meant to remain secret and prove control of the website identity.

For example, an attacker holding a valid site certificate’s private key could potentially present that certificate while impersonating the site. In some situations, the attacker might intercept a connection or trick users into sending passwords and other data to the wrong destination. The exact impact depends on the certificate, protocol, browser checks, and whether the certificate is revoked.

The supplied article does not list specific attacks, affected customers, or stolen information. It states that eMudhra’s TLS certificates, with private keys of 3 to 8 bits, were compromised. Following that incident, eMudhra said it would voluntarily withdraw from the global SSL/TLS certificate business.

Certificate authorities, often called CAs, issue SSL/TLS certificates after checking control of a domain and, for some certificates, an organization’s identity. They sign the certificate so browsers can verify that it came from an accepted authority. Browsers and operating systems trust selected CAs because their root certificates are installed in trusted stores and their operations must meet industry and platform requirements.

For example, when a browser visits a secure website, it checks the certificate’s domain name, dates, signatures, and chain to a trusted root. If those checks pass, the browser can accept the website’s public key for the connection. If a CA issues a bad certificate or loses control of a private key, software makers can distrust or revoke certificates.

The article identifies eMudhra as an Indian digital trust services provider and says its TLS certificates were compromised. It does not name other issuers, browsers, operating systems, validation procedures, or trust-store policies involved in this case.

Public-key cryptography uses a matched pair of keys. The public key can be shared with anyone, while the private key must remain secret. A TLS certificate binds the public key to a website’s identity. The website proves it controls the matching private key, allowing the browser to authenticate the server before protected communication begins.

For example, during a TLS handshake, the server presents its certificate and uses its private key to demonstrate control of the corresponding public key. The browser verifies the certificate’s signature chain and the website name. The two sides then establish temporary session keys, which are used to encrypt the actual data exchanged during the visit.

This system depends on private-key secrecy. If the private key is exposed, the identity proof can be abused. The article says eMudhra’s TLS certificates had private keys of only 3 to 8 bits and were compromised. It does not describe the specific cryptographic algorithm or handshake used.