Disgraced eMudhra drops out of TLS business after using cert private key of 4
Flubbed key signing “ceremony” allowed minting of web credentials for any site.
TL;DR
- eMudhra is exiting the SSL/TLS certificate business.
- The company issued eight weak intermediate TLS credentials with extremely low entropy private keys.
- These weak keys allowed anyone to mint trusted certificates for any website or mail server.
- eMudhra attributes the flaw to a faulty key generation ceremony (KGC) involving HSMs and an experimental wrap/unwrap process.
- Human errors and a flaw in the KGC script resulted in weaker keys being mistakenly used for certificate signing requests.
- Browser makers blocked the compromised certificates, but other devices may take longer to update or never receive the fix.
- The decision to withdraw is also influenced by rising compliance costs, low revenue contribution of the TLS business, and the availability of free TLS certificates.