eMudhra, an Indian certificate authority recognized globally, has announced its decision to exit the worldwide SSL/TLS certificate market. This significant move was confirmed by the company’s board following a report from a researcher who identified weak private keys in eight intermediate CA certificates.
Implications for Affected Users
eMudhra has pledged to provide free replacement certificates through partnerships, although it has not disclosed the partners or the timeline for this transition. The company is committed to ensuring continuity for its customers during this period. Notably, the affected certificates include six for website TLS certificates, which prompted Chrome to plan a cessation of trust in the eMudhra root certificate, emSign ECC Root CA – G3, by October 27.
Earlier, Mozilla also withdrew its trust in the same root certificate for Firefox, a decision that impacts tens of thousands of unexpired certificates linked to it. Primarily, these certificates were issued via InCommon, a service catering to the higher education sector that transitioned to eMudhra’s CertiNext platform earlier this year.
Immediate Actions and Future Developments
Google has advised website owners with certificates under the affected root to acquire new TLS certificates from alternative PKI hierarchies. In the interim, eMudhra’s G1 RSA root certificates will remain in service, though Chrome is still evaluating their place in its root store.
eMudhra will maintain its revocation and status services until all issued SSL/TLS certificates are either expired or replaced. Other facets of eMudhra’s operations, such as digital signature certificates and the CertiNext platform, will continue without interruption.
Repercussions and Industry Response
The revelation of the vulnerable keys has led to widespread scrutiny on social media, which eMudhra claims is disproportionate given the minimal revenue impact from the SSL/TLS sector—reportedly only 1% of its total income. The discovery was initially reported to major tech companies and eMudhra on October 17. The keys, which should have been complex random numbers, were inadequately generated, making them easily guessable.
Both Chrome and Firefox quickly blocked the compromised TLS intermediates. Despite the blocks, eMudhra asserts that these keys were never used to issue certificates to websites or users, and no security breaches occurred.
Customer Guidance and Ongoing Challenges
Institutions like Cornell and the University of Michigan have directed their certificate holders to opt for RSA certificates, as they remain unaffected for now. However, the situation remains fluid, with potential future trust issues anticipated.
eMudhra estimates that approximately 30,000 certificates need transitioning, with the majority issued via ACME protocol. Google’s Chrome has highlighted the need for manual intervention or ACME Renewal Information (ARI) to facilitate certificate replacement outside the standard renewal window.
As the industry awaits further clarification, the focus remains on ensuring secure transitions and addressing any residual vulnerabilities within eMudhra’s certificate infrastructure.
