eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable

Summary: eMudhra's board decided on Thursday to withdraw from its global SSL/TLS certificate business, five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates, six of them for TLS. Chrome will stop trusting the emSign ECC Root CA - G3 root on the morning of October 27 Pacific time, and Mozilla decided on October 20 to stop trusting the same root in Firefox, affecting about 30,800 unexpired certificates chained to that root as of October 21, 99.9% of them issued through InCommon.
Key Takeaway: Each of the eight private keys should have been a huge random number but was below 256, so anyone could work them out almost instantly - and Chrome said eMudhra's disclosure that the 2025 invalid CRLs were resigned with those same flawed keys raises serious concerns about its transparency and incident handling. With roughly 30,000 certificates to move, about 97% issued via ACME, and Chrome noting standard ACME clients do not replace certificates outside their renewal window without ARI support or manual intervention, the migration clock is shorter than the tooling most operators rely on.

Read the original at The Hacker News ↗