Indian tech company eMudhra announces withdrawal from certificate business after security incident
The issue was publicized by cybersecurity researcher Scott Helme, who published a blog saying that instead of a random 384-bit number, one of the company's private keys was just the number four.
Indian certification authority eMudhra has announced it will exit the global SSL/TLS certificate business following a series of embarrassing reports revealing weak private keys. The company disclosed on Thursday that it was discontinuing this arm of its operations, attributing the decision to weak keys and the rising costs and competition in the SSL/TLS certificate market.
The company emphasized that weak keys, ranging from 4 to 237, had been exposed, which could allow attackers to forge certificates trusted by systems not blocking them. Despite independent audits and a quick revocation of affected certificates, eMudhra acknowledged the key management failure and blamed a flaw in its key generation ceremony.
The company will continue to serve G1 RSA roots and provide free certificate issuer transitions, ensuring revocation and certificate status services remain active until all issued certificates expire or are replaced.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- Disgraced Indian cert issuer leaves the cert issuing business theregister.com
