EMUDHRA , an Indian certificate authority, has decided to withdraw from its global SSL/TLS certificate business. The board’s decision came five days after a researcher recovered private keys for eight of its intermediate CA certificates, six of which were TLS website certificates. The firm says it will replace affected customers’ certificates with free ones from partners, though it does not name the partners or set a date for the exit.
Chrome plans to stop trusting the emSign ECC Root CA - G3 that sits above those intermediates, with the change expected to reach users on the morning of 27 October, Pacific Time. Mozilla also decided to stop trusting the same root in Firefox on 20 October. In total, about 30,800 unexpired certificates chained to that root were active as of 21 October, most issued via InCommon, which had moved the service to eMudhra’s CertiNext platform between April and July this year.
Google has instructed operators affected by the root distrust to procure new TLS certificates from another PKI hierarchy included in the Chrome Root Store; until transition is complete, eMudhra’s G1 RSA root certificates will continue to serve customers, though Chrome is still deciding whether to retain other eMudhra certs in its root store.
The incident has raised questions about eMudhra’s transparency and incident handling, with eMudhra stating that the global SSL/TLS business accounts for roughly 1% of its revenue and that data sovereignty and compliance complexities make the operation costly. The firm emphasised that it never used the eight weak keys to issue certificates and that its systems were not breached.