eMudhra exits global TLS business after security flaw
What's the story
Bengaluru-based digital security firm, eMudhra, has announced its exit from the global website authentication certificate business. The company's board made the call on Thursday. The decision comes after a major security incident where eight of its intermediate security certificates were found to have weak private keys. SSL/TLS certificates are critical in helping browsers verify the authenticity of websites and establish secure connections with them.
Rapid action
No breach of infrastructure or data
V Srinivasan, Chairman of eMudhra, said the company revoked the affected certificate authorities within 14 hours of discovering the issue.
He clarified that there was no breach of the company's infrastructure or data in this incident.
The compromised certificates were not used for issuing certificates to individual websites or end users.
However, the flaw could have allowed attackers to create fake security certificates for websites they do not own.
Global response
Global response from tech giants
The security flaw has triggered a global response from tech giants Mozilla, Google, and Cloudflare. They have taken steps to prevent potential attacks using the compromised keys.
The issue was first reported on October 17 by Dennis Jackson of Mozilla's cryptography engineering team. He flagged weaknesses in the keys associated with eight eMudhra intermediate certificates due to insufficient randomness during generation.
Ongoing probe
Investigation into key-generation ceremony ongoing
In a recent update, eMudhra revealed that a flaw during a key-generation ceremony on April 30 last year led to the creation of a second set of weak keys. These were published to browser root stores.
The company is actively investigating this matter and will consider an independent investigation if its internal review fails to determine what happened.
Security advisory
Indian CERT-In advisory issued
The Indian Computer Emergency Response Team (CERT-In) has issued an advisory warning that compromised keys could be used to impersonate websites, intercept communications, or issue fraudulent code-signing certificates.
These certificates can make malicious software appear to come from a trusted publisher.
CERT-In has advised organizations to update their browsers, applications, and operating systems with the latest security patches.