eMudhra to Exit Global SSL/TLS Certificate Business

eMudhra’s board has decided to withdraw from the company’s global SSL/TLS certificate business after weak private keys were found in eight intermediate certificates, prompting browser trust restrictions. The company announced the decision on October 22, saying the business accounted for about 1% of its revenue. The vulnerability was reported on October 17, when a researcher notified eMudhra and major browser companies that the keys could be reconstructed from publicly available certificate information. Six of the eight intermediate certificates were used for website TLS certificates. eMudhra said the affected authorities had not issued certificates to websites or users, and that its infrastructure had not been breached. The company said it revoked the affected certificates. Browser action has focused on the emSign ECC Root CA G3, above the affected certificates. Mozilla decided on October 20 to stop trusting that root in Firefox. Chrome’s planned removal of trust was expected to reach users on October 27, Pacific time. A browser’s decision to distrust a root can also affect legitimate certificates issued beneath it. Chrome counted about 30,800 unexpired certificates chained to...