eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
Summary
eMudhra, an Indian certificate authority, will cease its global SSL/TLS certificate business following the discovery that eight of its intermediate CA private keys were easily guessable. The company plans to replace affected customers' certificates with free ones from partners.
IFF Assessment
The compromise of intermediate CA keys significantly undermines the trust in the TLS/SSL certificates issued by eMudhra, posing a direct threat to secure online communication and potentially enabling man-in-the-middle attacks.
Defender Context
This incident highlights the critical importance of robust key management practices for Certificate Authorities (CAs). Defenders should be aware of the potential for compromised trust anchors and the implications for website integrity and user data protection. It underscores the need for continuous auditing and security validation of CA operations.