eMudhra quits global TLS certificate market after compromise of CA signing keys

Publisher excerpt From CSO Online

Indian digital trust company eMudhra has announced that it is exiting the global SSL/TLS certificate business and is offering customers certificates issued by Sectigo as an alternative, following the compromise of private keys behind eight of its intermediate certificate authorities. The company’s board decided “to voluntarily withdraw from the global SSL/TLS certificate business,” eMudhra said in a press note. It added that data sovereignty and compliance requirements had increased the business’s complexity and cost. “The level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” eMudhra Chairman V Srinivasan said in the announcement. The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced. Sectigo offered as an alternative In the customer update, eMudhra said it is making Sectigo-issued certificates available to all its customers. “Our G1 root certificates remain active and continue to be fully supported,” the company said in the update. The October 22 release said the G1 RSA roots “will continue to serve customers until this transition is complete.” eMudhra said it would provide replacement certificates free of charge through its partners and continue operating revocation and certificate-status services until all cer…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.