eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
eMudhra , an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday .
On October 22, five days after a researcher showed that private keys for eight of its intermediate certificates could be recovered in under a second, Indian certificate authority eMudhra announced it will leave the global SSL/TLS certificate business.
eMudhra , an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday .
The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates.
The researcher reported the weak keys to Apple, Google, Microsoft, Mozilla and eMudhra on October 17.
Global SSL/TLS brings in about 1% of eMudhra’s global revenue, according to Srinivasan, and rising compliance costs, along with free certificates from large providers, had already reduced the returns from that business.
The incident's spread on social media has also brought "scrutiny that is out of proportion to SSL/TLS’s place in our business," the company said.
eMudhra said it will replace affected customers' certificates with free ones from partners, though its announcement did not name the partners or provide a date for the exit.
Google has told website operators with certificates under that root that they "must immediately acquire and install a new TLS certificate from another PKI hierarchy included in the Chrome Root Store." Until the transition is complete, eMudhra said, its G1 RSA root certificates will continue to serve customers.
eMudhra has stopped issuing from that root and estimates that about 30,000 customer certificates need to be replaced.
Chrome will stop trusting the eMudhra root certificate above them, emSign ECC Root CA - G3.
What happened
On October 22, five days after a researcher showed that private keys for eight of its intermediate certificates could be recovered in under a second, Indian certificate authority eMudhra announced it will leave the global SSL/TLS certificate business.
eMudhra , an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday .
What changed
The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates.
The researcher reported the weak keys to Apple, Google, Microsoft, Mozilla and eMudhra on October 17.
Who is affected
Global SSL/TLS brings in about 1% of eMudhra’s global revenue, according to Srinivasan, and rising compliance costs, along with free certificates from large providers, had already reduced the returns from that business.
The incident's spread on social media has also brought "scrutiny that is out of proportion to SSL/TLS’s place in our business," the company said.
Why it matters
eMudhra said it will replace affected customers' certificates with free ones from partners, though its announcement did not name the partners or provide a date for the exit.
Google has told website operators with certificates under that root that they "must immediately acquire and install a new TLS certificate from another PKI hierarchy included in the Chrome Root Store." Until the transition is complete, eMudhra said, its G1 RSA root certificates will continue to serve customers.
Technical details
eMudhra has stopped issuing from that root and estimates that about 30,000 customer certificates need to be replaced.
Chrome will stop trusting the eMudhra root certificate above them, emSign ECC Root CA - G3.
The certificates chain to roots trusted by Apple, Google, Microsoft and Mozilla.
Response
Browsers are protected, but apps, servers and devices that don’t receive revocation updates may still trust the certificates, Helme warned, which could expose user data to anyone able to intercept their traffic.
Its incident report at the time said it fixed them by "regenerating the CRLs using the appropriate private key associated with each Intermediate CA." On October 19, eMudhra told Mozilla that those lists were first signed with the keys it meant to use.
What security teams should do
A security researcher known as Wayne discovered the flaw on October 17 while running a check against the Common CA Database (CCADB).
What remains unknown
It is not known whether anyone recovered and used the weak keys in the 17 months before the flaw was reported.
Attribution
The Hacker News: eMudhra , an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday .
Help Net Security: Eight intermediate certificates issued by Indian certificate authority eMudhra were secured with private keys so weak that anyone could recover them from the public certificates in under a second.