eMudhra Quits Global SSL/TLS Certificates After Researcher Recovers Eight Intermediate CA Keys

Indian certificate authority eMudhra will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates. Six of the eight were for website (TLS) certificates. eMudhra says it will replace affected customers' certificates with free ones from partners, but it has not named the partners or given an exit date.

Browsers have already acted. Mozilla decided on October 20 to stop trusting the root certificate, emSign ECC Root CA - G3, in Firefox. Chrome will follow, with the change expected to reach users on the morning of October 27, Pacific time. Removing a root also cuts off legitimate certificates issued beneath it. As of October 21, about 30,800 unexpired certificates chained to that root, and 99.9% of them were issued through InCommon, the certificate service built for higher education. Google has told affected website operators they must immediately acquire and install a new TLS certificate from another hierarchy in the Chrome Root Store.

eMudhra's separate G1 RSA root certificates will keep serving customers during the transition, though Chrome is still deciding whether to keep the company's remaining CA certificates. Revocation and status services will continue until all its SSL/TLS certificates have expired or been replaced. Its other businesses, including digital signatures and eSign, will carry on. The company says SSL/TLS is about 1% of its revenue.