Digital trust firm eMudhra said on Thursday, October 22, that its board had decided to exit the global Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate business after Google, Apple and Mozilla moved to distrust eight of its certificates in their browsers.
The company said its digital signature certificates, eSign and other signing services, including those in India, would continue. Its enterprise public key infrastructure products, emCA and CertiNext, the emSigner suite, and identity and authentication products SecurePass and emAS will also remain operational.
V. Srinivasan, chairman of eMudhra, said the company revoked the affected certificate authorities (CAs) within 14 hours of discovering the issue. He said no end-entity certificates had been issued by them, its infrastructure had not been breached and no data had been lost.
Srinivasan said SSL/TLS contributed about 1% of the company’s global revenue. He cited rising data sovereignty and compliance requirements, as well as the availability of free SSL/TLS certificates, as factors behind the decision to exit the business.
The company also said the attention the incident received on social media was disproportionate to the size of the business.
eMudhra described the incident as a “one-off error” and a “process lapse” that occurred on a specific day. It said corrective measures had been taken, that the wider ecosystem had not suffered damage and that browsers had implemented remedial measures.
Also read: Online dating scams: How to spot red flags before you lose money
What happens to existing eMudhra SSL certificate customers?
eMudhra said its G1 RSA root certificates would continue serving customers until the transition was complete.
The company will contact affected customers and arrange replacement certificates through partners at no cost. Certificate revocation and status-checking services will remain operational until every issued certificate has expired or been replaced.
eMudhra also said it would fulfil its commitments to browser root programmes, including submitting a comprehensive root-cause report.
How the security flaw came to light
The issue surfaced on October 17, when a security researcher known as Wayne reported that eight intermediate certificates issued by eMudhra had private keys with an effective key space of just three to eight bits.
Such a small key space can be guessed almost instantly, potentially allowing an attacker to generate certificates for any domain and impersonate legitimate websites.
Wayne set up a website at emudhra.we-have-a-problem.com to demonstrate the flaw. Ben Cartwright-Cox, director of BGP.tools, described the issue as “bonkers” and suggested that example code might have made its way into production systems.
Google Chrome, Mozilla Firefox, Apple Safari and Microsoft Edge moved to block the affected certificates across their platforms by October 20.
Cloudflare confirmed the risk at about 17:00 UTC on October 19. It said it had found no active exploitation on its services and released updates to its WARP and 1.1.1.1 apps, as well as cloudflared, its tunnel software.