e Mudhra, the certificate authority that issued eight weak intermediate TLS credentials, is withdrawing from the global SSL/TLS business. The company's chairman, V. Srinivasan, cited increasing compliance costs and the fact that the business generated only 1 percent of revenue.
The decision follows the revelation that e Mudhra issued certificates with private keys ranging from 3 to 8 bits, far below the industry standard of 384 bits. This flaw allowed anyone to quickly crack the keys and mint trusted certificates for any website or server. While the company claimed social media amplification brought disproportionate scrutiny, the security risk was significant, compromising trust for IoT devices, Docker containers, and legacy systems.
The exit marks the end for a firm at the center of a major web security controversy.
Source: Ars Technica · Summarized by HeadlinesBriefing