So, eMudhra has decided to spice things up by revoking eight more of its CA certificates. Apparently, they had a little mishap with their private keys, which, as it turns out, were about as secure as a paper bag in a rainstorm.
What's the deal?
The latest revocation brings the grand total to 16 compromised intermediate CA certificates. Yes, that’s right! eMudhra's private keys were so weak that they practically invited hackers to help themselves.
This all stemmed from a "custom Python script" that eMudhra whipped up last April to move private keys between its fancy security devices. Big surprise, it turns out that the script was about as trustworthy as a fox guarding a henhouse. It reduced eight ECDSA private keys to just one byte, making them about as secure as an unlocked front door.
Not quite in the clear
The same script failed to keep eight RSA private keys safe either, letting them linger in the computer's memory like an embarrassing secret. While they weren’t as weak as the ECDSA keys, eMudhra couldn’t show that they followed the security rules they claim to abide by. So, naturally, they revoked those too.
Browsers shrug it off
When the news broke, major browsers like Mozilla, Google, and Apple dropped eMudhra's compromised certificates faster than unpopular snacks on a buffet table. They promptly issued updates to block the dodgy certificates, which could have let attackers impersonate legitimate websites and mess with encrypted communications. Fun times!
Microsoft even threw in some extra out-of-band updates to remove trust in the compromised certificate trust chains. Because nothing says "We care" like an emergency software patch.
The future is... uncertain?
In light of all this, eMudhra has announced it will kiss the publicly trusted TLS certificate business goodbye and will transition its customers to a new provider. They’re planning to stop issuing certificates under their existing G1 hierarchy by mid-November, just in time for the holiday season—perhaps to give everyone a break from their certificate woes?
The company is also having KPMG take a look under the hood to figure out how not to screw up their key management going forward, with findings due soon. Spoiler alert: they haven't seen evidence that the compromised keys were exploited... yet. Lucky them!
Stay tuned for more adventures in digital security—because if there’s one thing we can count on, it’s that eMudhra won’t be the last to bring chaos into the world of certificates.
