eMudhra Exits Global SSL/TLS Business After Weak CA Key Findings
eMudhra's board decided to leave the global SSL/TLS certificate business five days after a researcher found eight intermediate CA keys below 256 bits, while Chrome and Firefox move to distrust the emSign ECC G3 root, which affects about 30,000 mostly InCommon certificates.
Indian certificate authority eMudhra is withdrawing from its global SSL/TLS certificate business. The board made this decision on Thursday, five days after a researcher reported that eight intermediate CA certificates used private keys below 256. Six of these were for website TLS certificates.
The researcher reported the keys on October 17 to Apple, Google, Microsoft, Mozilla, and eMudhra. Chrome and Firefox blocked the six TLS intermediates within hours. Google stated no website certificate from them appeared in Certificate Transparency logs before the block. eMudhra reported it never used the eight keys to issue certificates to websites or users, and that its systems were not breached.
Chrome will stop trusting the root emSign ECC Root CA - G3 on the morning of October 27, Pacific time. Mozilla decided on October 20 to remove the same root from Firefox.
As of October 21, Chrome counted about 30,800 unexpired certificates chained to the root. InCommon issued 99.9% of them. InCommon moved its service to eMudhra's CertiNext platform between April and July. Google told site operators to acquire new TLS certificates from another PKI hierarchy.
eMudhra estimates about 30,000 certificates need to move, with 97% issued through ACME. Chrome noted that standard ACME clients do not replace certificates outside their renewal window without ARI support or manual intervention.
Cornell told certificate holders to request RSA certificates. The University of Michigan stated InCommon's RSA certificates are not currently affected, while noting their root could become distrusted.
Mozilla is not removing trust in the G1 root, emSign Root CA - G1, for now. Chrome is still deciding on eMudhra's remaining CA certificates. eMudhra stated G1 will serve customers until the transition finishes, and it is issuing affected US customers new certificates from an alternate CA hierarchy.
The global SSL/TLS business brings in about 1% of eMudhra's revenue. Revocation and status services will run until every SSL/TLS certificate issued has expired or been replaced. Digital signature certificates, eSign, and CertiNext will continue.