Indian digital security company eMudhra announced it is quitting its global SSL/TLS certificate business following researchers’ findings of eight compromised intermediate certificate authorities generated with a predictable seed.
The company’s board had decided to exit the business on Thursday, after the flaw was announced on Oct. 17. The flaw allowed the private keys to be quickly retrieved, and attackers could have used those keys to forge certificates and pose as websites.
Google and Mozilla began revoking those certificates, and other browser makers also removed trust in the root certificate. Google said none of the certificates issued via the six compromised website-security intermediates had appeared in publicly visible Certificate Transparency logs prior to their revocation.
eMudhra said it had revoked all eight intermediate certificates and there was no breach of its infrastructure. It also claimed that the compromised intermediates were not used to issue certificates to websites or end users.
Replacement certificates will be issued by the company free of charge to clients through partners. The company’s other services, such as digital signatures and eSign, will still be available.
The company’s international SSL/TLS business makes up around 1% of eMudhra’s revenue. In its prospectus, eMudhra said higher compliance requirements and competition from free certificate authorities had made the business less compelling.
This has led to concerns that online communications protected by digital certificates may not be secure and reliable.
