eMudhra investigates weak keys in eight certificates

eMudhra is investigating weak private keys linked to eight intermediate digital certificates in its global website-security business, after major technology companies moved to block or distrust the affected certificates. India’s Ministry of Electronics and Information Technology (MeitY) said the incident does not affect the company’s regulated Indian Digital Signature Certificate and eSign services. The certificates were part of the trust infrastructure used by browsers and other software to verify websites and secure connections. Researchers found that the keys were generated with insufficient randomness and could potentially be recovered, allowing someone who obtained them to create fraudulent certificates and impersonate legitimate websites. Two of the affected certificates were for code signing, according to a CERT-In advisory; the other six were TLS certificates used to secure online connections. Google, Apple, Microsoft and Mozilla have taken steps to block or distrust the affected certificates. Google has blocked the public keys of the affected TLS intermediates in Chrome and plans to remove the associated emSign ECC Root CA G3 from the Chrome Root Store, with rollout...