Disgraced Indian cert issuer leaves the cert issuing business
We didn't want to issue SSL/TLS certs anyway, Indian firm suggests after one private key turns out to be the number 4
Indian certification authority eMudhra has announced it will exit the global SSL/TLS certificate business following a series of embarrassing reports revealing weak private keys. The company disclosed on Thursday that it was discontinuing this arm of its operations, attributing the decision to weak keys and the rising costs and competition in the SSL/TLS certificate market.
The company emphasized that weak keys, ranging from 4 to 237, had been exposed, which could allow attackers to forge certificates trusted by systems not blocking them. Despite independent audits and a quick revocation of affected certificates, eMudhra acknowledged the key management failure and blamed a flaw in its key generation ceremony.
The company will continue to serve G1 RSA roots and provide free certificate issuer transitions, ensuring revocation and certificate status services remain active until all issued certificates expire or are replaced.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
