eMudhra Exits Global SSL/TLS Certificate Market Post Key Compromise

The Indian digital trust firm eMudhra has announced a strategic decision to exit the global SSL/TLS certificate market. This move comes in the wake of a significant security breach involving the compromise of private signing keys from eight of its intermediate certificate authorities.

Withdrawal from SSL/TLS Business

In a press release, eMudhra's board stated that the company will voluntarily withdraw from its operations in the global SSL/TLS certificate sector. The organization cited rising complexities associated with data sovereignty and compliance requirements as critical factors influencing this decision.

Chairman V Srinivasan expressed that the scrutiny resulting from this incident was disproportionate to the SSL/TLS services’ overall significance to eMudhra's business model.

Support for Affected Customers

eMudhra has committed to proactively contacting customers affected by the compromise and will facilitate the replacement of their SSL/TLS certificates at no charge. Furthermore, the company will maintain revocation and status services until all current certificates have either expired or been replaced.

As part of its transition plan, eMudhra has partnered with Sectigo, enabling customers to obtain Sectigo-issued certificates. The update emphasized that G1 root certificates remain operational and fully supported during this shift.

Expert Insights on Transitioning

Niyati Daftary, a principal analyst at Gartner, urged organizations to consider G1 roots as a temporary solution rather than a permanent fix. She advised enterprises to migrate their critical services to a fully trusted Certificate Authority (CA) as soon as possible.

Yash Kadakia, co-founder and CTO of Security Brigade, highlighted concerns regarding trust and governance. He advised against merely migrating to another root managed by the same company, emphasizing the importance of a well-planned transition to avoid multiple migrations.

Technical Considerations and Potential Risks

Identifying and replacing certificates in an enterprise setting will require careful planning. According to IDC's research director, Sakshi Grover, simply replacing the website’s certificate may not address all dependencies since various systems maintain their own trust store and may not update as frequently as browser systems do.

There could be lingering risks for systems requiring external connections, as many organizations may be unaware of where these trust decisions are made outside of conventional browsers and operating systems.

Azul, a leading Java vendor, noted that Java does not automatically check certificate revocations, which poses a risk if the associated JDK remains unpatched. They have already released updates that include the compromised certificates in their blocked-list.

Impending Deadline for Certificate Holders

In related news, Mozilla has removed the emSign ECC Root CA - G3 from its trust store, while Google has announced plans for its removal from the Chrome Root Store by the morning of October 27, Pacific Time. Website operators with certificates linked to the compromised root need to act swiftly to obtain new TLS certificates to prevent service disruptions.

Daftary emphasized the need for enterprises to deepen their understanding of their certificate resellers to mitigate fourth-party risks, which could lead to widespread issues across multiple services.