eMudhra exits SSL/TLS business after weak CA keys found
Original title: eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
Researcher recovered private keys of eight intermediate CAs that were below 256 bits, leading to root distrust and business exit.
eMudhra will withdraw from its global SSL/TLS certificate business after eight intermediate CA private keys were found easily guessable. The keys were reported to Apple, Google, Microsoft, Mozilla and eMudhra on October 17. Chrome and Mozilla have stopped trusting the associated root certificates, affecting about 30,800 certificates. eMudhra will replace affected certificates for free and keep revocation services running until all are expired.
Unconfirmed: Whether eMudhra's RSA root will also be distrusted remains undecided.
- Eight intermediate CA keys below 256 bits
- Chrome distrusts emSign ECC Root CA - G3
- 30,800 certificates affected per Chrome CT logs
Impact: weak private keys in intermediate CAs allowing key recovery
- 1.replace affected certificates
- 2.update browsers
- Vendors
- eMudhra
From the original article
5 min read at thehackernews.com
eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. eMudhra said it will replace affected customers' certificates with free ones from partners, though its
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.