# A Major Certificate Authority Exits the SSL/TLS Business After Security Findings
The world of internet security recently faced a significant development when an Indian certificate authority announced it would be pulling out of the global SSL/TLS certificate market entirely. This decision followed the discovery that several of its internal security keys were dangerously weak, raising serious questions about the trustworthiness of digital certificates used to secure websites around the world.
## What Happened?
Security researchers discovered that eight intermediate certificate keys held by this authority were shockingly easy to crack. Instead of being long, complex random numbers designed to take centuries to guess, all eight keys were short enough that anyone with basic computing tools could decode them in seconds. While the company insists that none of these weak keys were ever used to issue certificates to real websites or users, the discovery was enough to trigger a chain reaction across the global browser community.
Within days, major browsers including Google Chrome and Mozilla Firefox moved to stop trusting a specific certificate hierarchy issued by the company. This meant that any websites relying on certificates linked to that hierarchy would be flagged as insecure to visitors. Chrome’s update was expected to reach users in late October.
## The Scale of the Impact
The effects rippled far beyond the certificate authority itself. Thousands of legitimate, unexpired certificates were tied to the distrusted root, the vast majority of which belonged to universities and research institutions through a shared certificate service. Organizations like Cornell University alone had over 300 certificates that needed urgent replacement.
The certificate authority estimated that roughly 30,000 certificates would need to be migrated to a different security provider. Most of these were already set up to renew automatically, which offered a path toward a smooth transition — but only if the underlying trust chain could be reconfigured correctly.
## The Company’s Response
The certificate authority said it would replace affected customers’ certificates with free ones from partner organizations, though it did not name those partners or provide a specific timeline for the full exit. It emphasized that the weak keys were never used in the wild, that its systems were never breached, and that the global SSL/TLS business accounted for only about one percent of its overall revenue.
The company also pointed to growing regulatory complexity and the fact that many large technology providers now offer SSL/TLS certificates for free as factors driving its decision to leave the market. It stated that its other services — including digital signature certificates and electronic signature platforms — would continue operating normally.
## Lingering Questions
Not all browsers followed the same timeline. While Chrome moved quickly to distrust the affected hierarchy, Mozilla took a more cautious approach, deciding at least initially to maintain trust in the company’s remaining root certificates. This left some institutions in a state of uncertainty, wondering whether their backup certificates would also lose trust over time.
Browser teams also raised concerns about the company’s handling of a similar incident from the previous year, when invalid revocation lists had been published due to key management errors. Questions were raised about transparency and whether the company had fully addressed the root causes of those earlier mistakes.
—
## Frequently Asked Questions
**What is a certificate authority?**
A certificate authority (CA) is a trusted organization that issues digital certificates used to verify the identity of websites and encrypt data between users and servers. Browsers maintain a list of trusted CAs, and certificates from those authorities allow websites to display the padlock icon in the address bar.
**Why were the private keys a problem?**
Private keys are the secret half of a cryptographic pair. They are supposed to be extremely long random numbers that are practically impossible to guess. When keys are too short or too simple, attackers can reconstruct them and impersonate legitimate websites or issue fraudulent certificates.
**Will affected websites stop working?**
If the certificates are not replaced before browsers stop trusting the old root, visitors to those websites will see security warnings. Most organizations affected by this issue were given advance notice and had time to migrate to new certificates from a different authority.
**What is the difference between ECC and RSA certificates?**
ECC (Elliptic Curve Cryptography) and RSA are two different mathematical approaches to generating cryptographic keys. ECC keys are generally shorter and faster, but both types are widely supported. In this case, one type used a distrusted root while the other used a root that browsers initially chose to keep trusting.
**Is the company still in business?**
Yes. The certificate authority is not going out of business overall. It is only exiting its SSL/TLS certificate operations. Other services such as digital signatures, electronic signing platforms, and identity verification products will continue.
**What should a website operator do if affected?**
Affected operators should contact their certificate provider or IT team to obtain replacement certificates from a different trusted authority. Most modern systems can automate this process, but configuration changes may be needed depending on the current setup.
—
## Conclusion
This incident highlights the interconnected nature of internet security infrastructure. A single vulnerability in one organization’s certificate management can have widespread consequences for universities, research institutions, and countless websites that depend on trusted digital certificates. The swift action taken by browser developers to distrust the compromised hierarchy helped limit the window of risk, but the episode also exposed gaps in transparency and incident response that will likely be scrutinized by the security community for some time. As the certificate authority completes its exit from SSL/TLS, the affected organizations will need to ensure a careful and timely migration to maintain the trust and security of their online presence.
Thank you for reading
