Covered by 2 outlets — first reported by The Register Security, Oct 22, 16:58 UTC
Disgraced Indian cert issuer leaves the cert issuing business
In brief
After embarrassing reports revealed weak private keys, one of which was just a single digit, Indian certification authority eMudhra has decided to take the L and get out of the global SSL/TLS cert game entirely. eMudhra announced Thursday that it was abandoning that arm of its business.
From The Register Security's coverage.
Continue reading
2 outlets, in the order they reported it.
The Register SecurityFirst report
Disgraced Indian cert issuer leaves the cert issuing business
After embarrassing reports revealed weak private keys, one of which was just a single digit, Indian certification authority eMudhra has decided to take the L and get out of the global SSL/TLS cert game entirely.
Ars Technica Security
Disgraced eMudhra drops out of TLS business after using cert private key of 4
eMudhra, the certificate authority that issued eight intermediate TLS credentials so weak that anyone could mint certificates for any website or mail server—one had a private encryption key of just 4—said it’s getting out of the business.
Explained
The technology and terms in this story. Learn more
- ConceptCertificate authorityAn organisation trusted to vouch for a website's identity by signing its certificate.
- ProtocolTLS · Transport Layer SecurityThe encryption protocol behind HTTPS: it keeps traffic between two programs private and proves who the server is.
- ProtocolSSL · Secure Sockets LayerThe retired predecessor of TLS; the name lives on in product names such as OpenSSL and "SSL VPN".