{"id":10147,"date":"2026-10-23T10:34:39","date_gmt":"2026-10-23T10:34:39","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10147"},"modified":"2026-10-23T10:34:39","modified_gmt":"2026-10-23T10:34:39","slug":"emudhra-quits-global-tls-certificate-market-after-compromise-of-ca-signing-keys","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10147","title":{"rendered":"eMudhra quits global TLS certificate market after compromise of CA signing keys"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Indian digital trust company eMudhra has announced that it is exiting the global SSL\/TLS certificate business and is offering customers certificates issued by Sectigo as an alternative, following the compromise of private keys behind eight of its intermediate certificate authorities.<\/p>\n

The company\u2019s board decided \u201cto voluntarily withdraw from the global SSL\/TLS certificate business,\u201d eMudhra said in a press note<\/a>. It added that data sovereignty and compliance requirements had increased the business\u2019s complexity and cost.<\/p>\n

\u201cThe level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL\/TLS\u2019s place in our business,\u201d eMudhra Chairman V Srinivasan said in the announcement.<\/p>\n

The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced.<\/p>\n

Sectigo offered as an alternative<\/h2>\n

In the customer update, eMudhra said it is making Sectigo-issued certificates available to all its customers.<\/p>\n

\u201cOur G1 root certificates remain active and continue to be fully supported,\u201d the company said in the update. The October 22 release said the G1 RSA roots \u201cwill continue to serve customers until this transition is complete.\u201d<\/p>\n

eMudhra said it would provide replacement certificates free of charge through its partners and continue operating revocation and certificate-status services until all certificates it issued had expired or been replaced. CertiNext users can request Sectigo certificates through their accounts; other customers can contact eMudhra support, the statement added.<\/p>\n

Niyati Daftary, principal analyst at Gartner, said organizations should view the G1 roots \u201cas a possible bridge, not automatically as the final destination.\u201d<\/p>\n

\u201cWith the company exiting global SSL\/TLS and its remaining roots still subject to browser scrutiny, the prudent course is to move critical services to an independent, fully trusted CA wherever the deadline allows,\u201d Daftary said.<\/p>\n

If G1 is used to prevent an immediate outage, she recommended setting a firm deadline and documenting a subsequent migration plan.<\/p>\n

She recommended including issuing authorities, intermediate and root certificates, cross-signing arrangements, revocation infrastructure, and browser trust status in third-party risk assessments.<\/p>\n

Yash Kadakia, co-founder and CTO of Security Brigade, said that moving to another root operated by the same company does not necessarily address concerns over trust and governance.<\/p>\n

\u201cThe last thing organisations need is to migrate twice,\u201d Kadakia said.<\/p>\n

Sectigo did not immediately respond to a request for comment.<\/p>\n

Java and other systems may need separate fixes<\/h2>\n

Replacing a website\u2019s certificate may not address every dependency in an enterprise environment, according to Sakshi Grover, research director at IDC. She said residual exposure lies in systems that maintain their own trust stores and do not update on the same schedule as browsers. These include Java keystores, language runtimes, container images, mutual TLS configurations, proxies, load balancers, VPN and security appliances, and embedded devices.<\/p>\n

\u201cThe harder finding for many organizations will be that they can\u2019t answer these questions at all,\u201d Grover said, referring to where certificate trust decisions are made outside browsers and operating systems.<\/p>\n

Grover noted that Google reported finding no certificates chaining to the affected intermediates in Certificate Transparency logs before they were blocked. She said that was reassuring for clients that enforce Certificate Transparency, but some non-browser applications and devices do not. Exploitation would also require an attacker to be positioned to intercept traffic, she said, describing the remaining risk as limited and targeted rather than broad.<\/p>\n

Azul, a Java vendor, said<\/a> in a statement that Java does not check certificate revocation by default. An unpatched Java Development Kit (JDK) could therefore continue to accept a forged certificate signed with a compromised intermediate key if the relevant chain remains trusted.<\/p>\n

Azul said it released updated Azul Zulu Builds of OpenJDK and Azul Prime. The updates add the eight affected certificates to the JDK\u2019s blocked-certificate list, the company said.<\/p>\n

Grover recommended that security teams first identify where trust decisions occur outside browsers and operating systems, prioritising systems that accept connections from external parties and mutual TLS endpoints. Teams should then determine which systems can be updated to distrust a specific intermediate certificate or public key, she said.<\/p>\n

Chrome deadline for certificate holders<\/h2>\n

Mozilla has removed emSign ECC Root CA \u2013 G3, the root that signed the eight compromised intermediates<\/a>, from its trust store. Google said in a blog post<\/a> that the root\u2019s removal from the Chrome Root Store is expected to reach all devices on the morning of October 27, Pacific time.<\/p>\n

\u201cTo avoid breakage, website operators with certificates chaining to emSign ECC Root CA \u2013 G3 must immediately acquire and install a new TLS certificate,\u201d Google said in the post.<\/p>\n

Daftary said enterprises often know their certificate reseller but not the CA hierarchy underpinning their trust.<\/p>\n

\u201cThat creates an unrecognized fourth-party risk capable of affecting thousands of services at once,\u201d she said. She added that CISOs should include issuing CAs, roots, cross-signing arrangements, and revocation infrastructure in their third-party cyber risk assessments. \u201cYou can outsource a service, but you cannot outsource accountability,\u201d Kadakia said.<\/p>\n

The article originally appeared on ComputerWorld<\/a>.<\/em><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Indian digital trust company eMudhra has announced that it is exiting the global SSL\/TLS certificate business and is offering customers certificates issued by Sectigo as an alternative, following the compromise of private keys behind eight of its intermediate certificate authorities. The company\u2019s board decided \u201cto voluntarily withdraw from the global SSL\/TLS certificate business,\u201d eMudhra said […]<\/p>\n","protected":false},"author":0,"featured_media":10148,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10147","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10147"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10147"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10147\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10148"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}