eMudhra Revokes Eight More CAs After Key-Handling Failures
Summary
eMudhra revoked eight additional RSA intermediate CAs after finding their private keys passed through a Python process and it could not verify handling compliance. The company says no misuse is known; browser and operating-system trust is being phased out.
Key points
- The eight newly revoked RSA CAs were read back through the company's ceremony script; eMudhra says it cannot demonstrate that the key material was handled in line with its rules.
- Unlike the eight ECDSA keys involved in the October compromise, the RSA keys were not shortened, but private components were present in the ceremony computer's Python process memory.
- The company revoked the eight RSA CAs using the reason code cessationOfOperation, rather than keyCompromise.
- The affected CAs issued 195 certificates, including 29 for eMudhra's own domains; the company says all certificate holders have moved to new certificates.
- eMudhra says it knows of no misuse. The article notes that Certificate Transparency-enforcing browsers could not have been fooled, while use against software that skips that check is unknown.
- eMudhra is exiting the publicly trusted TLS business, and browser and operating-system vendors are phasing out trust in its remaining roots and certificates.
Article Details
- Event Type
- eMudhra revoked eight additional intermediate certificate authorities after determining it could not demonstrate that their private keys were handled in compliance with its procedures.
- Impact
- The revoked CAs had issued 195 certificates, and eMudhra says all holders have moved to replacement certificates. The company knows of no misuse. The earlier-compromised keys could have enabled website impersonation, although the article says browsers enforcing Certificate Transparency could not have been fooled. Microsoft, Apple, Chrome, and Firefox are also removing or ending trust in affected eMudhra roots on announced schedules.
People
Vendors
AppleAccording to the Indian company's phase-out schedule, Chrome and Firefox will not trust G1 certificates issued after November 16, and Apple will end trust in all G1 certificates, including older ones, on November 30.eMudhraThe in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys.MicrosoftMicrosoft will start removing the 10 remaining eMudhra roots, including emSign Root CA - G1, on November 16, according to an update to its security response post earlier this week. Certificates that chain to those roots
Products
curlmacOS 27.2.1, 26.7.3 and 15.8.3 stop bundled command-line tools such as curl and git from accepting the compromised TLS CA certificates, Apple said in a support note earlier this week. They also drop 5 roots, includingEdgepost earlier this week. Certificates that chain to those roots will then lose default trust in Windows and Edge, and in some of its other products on their own timelines.emSigneMudhra, which sells certificates under the emSign brand, is exiting the publicly trusted TLS business following its October 22 announcement.GitmacOS 27.2.1, 26.7.3 and 15.8.3 stop bundled command-line tools such as curl and git from accepting the compromised TLS CA certificates, Apple said in a support note earlier this week. They also drop 5 roots, includingGoogle ChromeAccording to the Indian company's phase-out schedule, Chrome and Firefox will not trust G1 certificates issued after November 16, and Apple will end trust in all G1 certificates, including older ones, on November 30.macOSmacOS 27.2.1, 26.7.3 and 15.8.3 stop bundled command-line tools such as curl and git from accepting the compromised TLS CA certificates, Apple said in a support note earlier this week. They also drop 5 roots, includingMicrosoft Windowsresponse post earlier this week. Certificates that chain to those roots will then lose default trust in Windows and Edge, and in some of its other products on their own timelines.Mozilla FirefoxAccording to the Indian company's phase-out schedule, Chrome and Firefox will not trust G1 certificates issued after November 16, and Apple will end trust in all G1 certificates, including older ones, on November 30.