eMudhra exits global TLS certificates after weak-key disclosures
Indian certification authority eMudhra is leaving the global SSL/TLS certificate business after reports exposed eight weak private keys, including one with the value 4. The company said the scrutiny contributed to its decision, alongside rising compliance costs and competition from free certificate providers.
The affected keys belonged to eight intermediate certificate authorities, which could potentially have enabled forged certificates, though eMudhra says they issued no end-entity certificates. It says it revoked the authorities within 14 hours of discovering the issue and that no infrastructure or data was compromised. eMudhra will publish a root-cause report, honour remaining browser programme commitments and move customers to other issuers free of charge.
In short
- eMudhra is withdrawing from global SSL/TLS certificates.
- Reports found eight weak keys, including one valued at 4.
- The company says no end-entity certificates were issued by the affected authorities.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Exiting the global TLS certificate business can be seen as a responsible way to reduce risk after disclosures of weak private keys, even if eMudhra says they issued no end-entity certificates and that it revoked the authorities promptly. The company also cites rising compliance costs and free alternatives; winding down while supporting customer migration and honouring existing commitments may protect users and let it focus on other work.
The case against
Leaving the market may be seen as a disproportionate response if the affected authorities issued no end-entity certificates, were revoked within 14 hours and no compromise occurred. A transparent root-cause report, stronger controls and continued participation could preserve customer choice and demonstrate that the problems can be addressed without withdrawing from a security-critical service.
Read the full article at the source →
Originally published by The Register as “Disgraced Indian cert issuer leaves the cert issuing business”.