eMudhra quits global TLS certificate business after weak-key scandal

According to The Hacker News, an unnamed researcher told Apple, Google, Microsoft, Mozilla and eMudhra on 17 October that all 8 intermediate keys were numbers below 256. An SSL/TLS certificate is the digital credential a browser uses to confirm that a site is genuine; if the private key can be guessed, fake site certificates can be issued. 6 of the 8 keys were for TLS, and Chrome blocked them within hours. On 20 October Mozilla decided to distrust the emSign ECC Root CA - G3 root, while keeping the G1 root for now.

Certificate Transparency logs counted by Chrome show about 30,800 unexpired certificates chained to the ECC root as of 21 October, 99.9% of them issued through the US InCommon service. A company statement carried by ANI says the global SSL/TLS business accounts for about 1% of revenue. Chairman V. Srinivasan said the affected authorities were revoked within 14 hours of discovery, that the infrastructure was not compromised and that no data was breached. The company will offer customers free certificate replacement through partners, but has not named the partners or given a date for its exit.

The company stresses that its digital signature certificate, e-signature and enterprise public key infrastructure businesses in India are unaffected. On 22 October, however, Rajeev Chandrasekhar, the BJP's Kerala state president, called the incident troubling and asked the government to open an investigation into the company. Figures on the fall in its share price differ between sources and could not be verified against exchange data.