As cited
Copy frozen at (site build).
breaches incidents
Disgraced Indian cert issuer leaves the cert issuing business
Indian certificate authority eMudhra announced October 22 that it will exit the global SSL/TLS certificate issuance business following the discovery of weak private keys, some with values as low as 4. The incident exposed eight intermediate certificate authorities with inadequate key generation, though eMudhra claims no end-entity certificates were affected and the CAs were revoked within 14 hours. The company cited low revenue contribution (1 percent of global revenue), competition from free providers, and compliance costs alongside the recent scrutiny as reasons for the decision.
Why it matters: Organizations relying on eMudhra-issued certificates must plan migration to alternative certificate authorities before services end, and security teams should review their certificate inventory to identify any eMudhra CAs that may need revocation or replacement in their trust stores.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
breaches incidents
Disgraced Indian cert issuer leaves the cert issuing business
Indian certificate authority eMudhra announced October 22 that it will exit the global SSL/TLS certificate issuance business following the discovery of weak private keys, some with values as low as 4. The incident exposed eight intermediate certificate authorities with inadequate key generation, though eMudhra claims no end-entity certificates were affected and the CAs were revoked within 14 hours. The company cited low revenue contribution (1 percent of global revenue), competition from free providers, and compliance costs alongside the recent scrutiny as reasons for the decision.
Why it matters: Organizations relying on eMudhra-issued certificates must plan migration to alternative certificate authorities before services end, and security teams should review their certificate inventory to identify any eMudhra CAs that may need revocation or replacement in their trust stores.
- Source published
- First seen by Cybersecurity Tracker