eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its
eMudhra, an Indian certificate authority, will withdraw from its global SSL/TLS certificate business following the discovery of easily guessable private keys for eight of its intermediate CA certificates. The decision came after a researcher reported the weak keys on October 17, which led to Chrome and Mozilla blocking the affected intermediates.
Approximately 30,800 unexpired certificates chained to the eMudhra root certificate will need to be replaced with free certificates from partner organizations. Until the transition is complete, eMudhra's G1 RSA root certificates will continue to serve customers, but Chrome is still deciding whether to keep the affected CA certificates in its root store.
The incident highlights the importance of robust key management and the potential impact of weak keys on the security of SSL/TLS certificates.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
Also reported by 1 other outlet
- eMudhra to Exit Global SSL/TLS Certificate Business; news.ycombinator.com
