eMudhra exits global TLS market after intermediate CA keys compromised
Original title: eMudhra quits global TLS certificate market after compromise of CA signing keys
Chrome is set to drop emSign ECC Root CA – G3 on the morning of October 27; Mozilla has already removed it.
Indian trust company eMudhra said it is voluntarily leaving the global SSL/TLS certificate business after private keys for eight intermediate certificate authorities were compromised. It will offer free Sectigo replacements, keep G1 roots active during the transition, and run revocation services until issued certificates expire or are replaced. Google found no certificates chaining to the affected intermediates in Certificate Transparency logs before they were blocked; Azul added the eight certificates to its JDK block lists.
Unconfirmed: How the intermediate keys were compromised is not described, and Sectigo did not comment.
- Website operators chaining to emSign ECC Root CA – G3 must install a new certificate.
- CertiNext users can request Sectigo certificates in their accounts; others contact support.
- Azul said unpatched JDKs do not check revocation by default and may still trust a forged chain.
- Google said remaining risk needs an attacker positioned to intercept traffic.
Impact: Compromised intermediate CA keys could forge trusted TLS certificates
| Product | Affected | Fixed in |
|---|---|---|
| eMudhra emSign ECC Root CA – G3 and eight intermediate CAs | — | — |
| Azul Zulu Builds of OpenJDK and Azul Prime | unpatched JDK builds that still trust the chain | builds that add the eight certificates to the blocked list |
- 1.Replace certificates chaining to emSign ECC Root CA – G3 before Chrome’s October 27 removal.
- 2.Update Java and other private trust stores so the eight intermediates are distrusted.
- 3.Treat G1 roots as a temporary bridge and plan a move to an independent CA.
- Organizations
- GartnerIDCSecurity Brigade
- Countries
- India
From the original article
4 min read at csoonline.com
Indian digital trust company eMudhra has announced that it is exiting the global SSL/TLS certificate business and is offering customers certificates issued by Sectigo as an alternative, following the compromise of private keys behind eight of its intermediate certificate authorities. The company’s board decided “to voluntarily withdraw from the global SSL/TLS certificate business,” eMudhra said in a press note.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.