eMudhra is exiting its global SSL/TLS certificate business after a researcher recovered eight weak intermediate CA private keys.
Chrome and Firefox blocked the affected intermediates within hours.
The development follows a report by a researcher on October 12th, who found that eight digital foundation keys were extremely weak and easily guessable, as they were below 256. Of these, six involved website certificates. eMudhra said its systems were not compromised and that it never used the eight keys to issue certificates.
Immediate response from browsers
Within hours of the report, Chrome and Firefox browsers stopped trusting the affected parts of the certification system. Google said that no certificates from those points had appeared in public logs prior to the block.
Approximately 30.800 active certificates were associated with the core infrastructure as of October 21. Approximately 99,9% of these were issued through the InCommon service for the higher education community.
READ ALSO
Chinese cyberattackers breached ConnectWise backups and targeted thousands of organizations
What will happen to the customers?
eMudhra said it will replace affected customers' certificates free of charge through partners, while its older root certificates will continue to serve users during the transition. Global website certificate business accounted for about 1% of the company's revenue.
The company will keep its validation services active until all certificates expire or are fully replaced. The company's other services, such as digital signatures and eSign, will continue as normal.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)