eMudhra Exits Global SSL/TLS Certificate Business After Weak-Key Incident

On October 22, eMudhra announced it is exiting the global SSL/TLS certificate market. The announcement follows the previously reported weak-key issue affecting eight of its intermediate certificate authorities. Customers can expect to move to other providers and will need to follow the rules set for that migration.

What the company’s decision changes

The company’s board made the decision. In its statement, eMudhra cites rising costs, compliance requirements and the complexity of running this business. The company presents the exit as a change limited to global SSL/TLS certificates and separate from its other trust services and enterprise solutions.

The news here is the company leaving this business, not a new disclosure about the key flaws. Reuters and The Record each reported the decision on October 22. The earlier incident led browser vendors to restrict trust in the affected certificates.

How the transition is expected to work

eMudhra says it will work with browser root programs and with customers. According to the statement, the G1 RSA roots will continue to serve customers until the transition is complete. The company says it will contact affected customers and replace their certificates free of charge through partners.

Revocation and status-checking services are to stay online until every issued certificate has expired or been replaced. The company also says it will meet its remaining obligations to the root programs, including a report on the root cause of the issue. These are the company’s commitments, and customers should check whether it delivers on them.

What to check in your organization

• Find out whether any certificates you use, or their chains of trust, rely on eMudhra or emSign.
• Record certificate expiration dates and who is responsible for replacing each one.
• Check the official migration instructions before making changes to your services.
• Test connections after replacing a certificate, including in applications and automated tools.

SecurHUB commentary

The coming switch to a new provider shows why you need an up-to-date inventory of certificates and of the services that depend on them. Security audits help you identify who is responsible for renewing and replacing certificates and for checking that they are configured correctly.

Sources: eMudhra statement, The Record, Reuters / MarketScreener