eMudhra quits global TLS certificate market after compromise of CA signing keys
Summary
Indian digital trust company eMudhra is exiting the global SSL/TLS certificate market after its intermediate certificate authority signing keys were compromised. The company will offer customers certificates issued by Sectigo as an alternative and will continue to provide revocation services until all affected certificates have expired or been replaced.
IFF Assessment
The compromise of CA signing keys and the subsequent exit from the market by eMudhra represents a significant security incident that erodes trust in a critical infrastructure component.
Defender Context
This incident highlights the critical importance of securing Certificate Authority (CA) signing keys, as their compromise can lead to widespread distrust and necessitate costly remediation efforts. Defenders should monitor for the impact of this incident on TLS certificate trust and be prepared to re-issue or replace certificates that may be affected.