eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

{"heading_1":"The Incident","subheading_1":"eMudhra's Weak Keys","content_1":"eMudhra, an Indian certificate authority, reported eight weak intermediate CA keys, which were easily guessable. The keys were below 256 bits, making them vulnerable to brute force attacks.","subheading_2":"Browser Actions","content_2":"Chrome and Firefox blocked the six TLS intermediates within hours of the report. No website certificate from them had appeared in Certificate Transparency (CT) logs before Chrome's block, so none could have been used against Chrome or other software that requires CT logging.","subheading_3":"eMudhra's Response","content_3":"eMudhra stated that it never used the eight weak keys to issue certificates to websites or users. The company will replace affected customers' certificates with free ones from partners. The global SSL/TLS business brings in about 1% of its revenue.","subheading_4":"Industry Impact","content_4":"The incident affected about 30,800 unexpired certificates, with 99.9% issued through InCommon. eMudhra will keep its revocation and status services running until every SSL/TLS certificate it issued has expired or been replaced. Its other businesses, including digital signature certificates, eSign, and the CertiNext platform InCommon uses, will continue."}