eMudhra Has Quit TLS. The Accountability Questions Haven’t
On October 27, Google removed eMudhra’s root certificate called emSign ECC Root CA – G3. Any website still relying on…
On October 27, Google removed eMudhra's root certificate, emSign ECC Root CA – G3, from its systems. This action followed a series of events that began mid-October with Bengaluru-based eMudhra, India's largest licensed certifying authority. A researcher discovered that the private keys of eight certificate authorities under eMudhra's hierarchy were extremely weak.
One of the weak keys was the number 4. In response, major browser makers blocked the certificates within hours, and eMudhra revoked them. Within five days, eMudhra's board decided to exit the global TLS certificate business. However, the response to the security incident in India has been slower. The IT ministry formed a special team to investigate, and CERT-In issued an advisory four days after the vulnerability was reported.
The question remains: who is accountable for a certificate authority's actions in India, and what rules may have been broken?
Written by urgent.news from Inc42's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
