eMudhra Exits Global TLS Certificates After Eight CA Keys Are Compromised
eMudhra’s exit from the global SSL/TLS certificate business turns a compromise affecting eight intermediate certificate authorities into a migration task for customers—and a reminder that certificate trust extends well beyond browsers. The Indian digital trust company says it will provide replacement certificates through Sectigo and keep certificate status and revocation services running during the transition.
The company’s board chose to withdraw voluntarily, citing the rising complexity and cost of data sovereignty and compliance requirements. Chairman V Srinivasan said social media attention around the incident had brought scrutiny disproportionate to SSL/TLS’s role in eMudhra’s business.
Replacement certificates and the G1 roots
eMudhra says affected customers will be contacted and offered replacement certificates at no charge. CertiNext users can request Sectigo certificates through their accounts; other customers can contact eMudhra support. The company plans to maintain revocation and certificate status services until every certificate it issued has expired or been replaced.
Its G1 RSA root certificates remain active and supported while the transition is underway. That may give some organizations time to avoid an immediate service interruption, but Gartner principal analyst Niyati Daftary cautioned against treating G1 as a default long-term home. With eMudhra leaving the global market and its remaining roots still under browser scrutiny, she advised moving critical services to an independent, fully trusted certificate authority when deadlines permit.
If an organization uses G1 as a temporary bridge, Daftary recommends setting a firm migration deadline and documenting the next step. She also urged teams to include issuing authorities, intermediate and root certificates, cross-signing, revocation services and browser trust status in third-party risk reviews.
Security Brigade co-founder and CTO Yash Kadakia raised a related concern: changing to another root run by the same company may leave questions about trust and governance unresolved. “The last thing organisations need is to migrate twice,” he said. Sectigo had not responded to a request for comment at the time of publication.
Certificate changes reach beyond websites
Replacing a public-facing website certificate won’t necessarily remove every enterprise dependency. IDC research director Sakshi Grover pointed to systems with their own trust stores and separate update cycles, including Java keystores, language runtimes, container images, mutual TLS configurations, proxies, load balancers, VPN and security appliances, and embedded devices.
For many organizations, Grover said, the initial challenge may be finding where those systems make trust decisions at all. Google reported that it found no certificates chaining to the affected intermediates in Certificate Transparency logs before blocking them. That offers some reassurance for clients that enforce Certificate Transparency, but some applications and devices don’t. An attacker would also need to be positioned to intercept traffic, leaving a risk Grover characterized as limited and targeted rather than broad.
Java environments warrant particular attention. Azul, a Java vendor, said certificate revocation checking is off by default in Java. An unpatched Java Development Kit could therefore continue accepting a forged certificate signed with a compromised intermediate key if the certificate chain remains trusted.
Azul has released updated Azul Zulu Builds of OpenJDK and Azul Prime. The releases add the eight affected certificates to the JDK’s blocked-certificate list. Grover recommends that security teams first map trust decisions outside browsers and operating systems, prioritizing systems that accept external connections and mutual TLS endpoints. Teams should then check which systems can be updated to distrust a specific intermediate certificate or public key.
Browser trust changes set the migration pace
Mozilla has removed emSign ECC Root CA – G3, which signed the eight compromised intermediates, from its trust store. Google said removal from the Chrome Root Store was expected to reach all devices on the morning of October 27, Pacific time. It told website operators whose certificates chain to that root to obtain and install new TLS certificates immediately to avoid service disruption.
Daftary said organizations may know their certificate reseller without knowing the certificate authority hierarchy beneath it. That gap can create a fourth-party risk affecting many services at once. Kadakia’s point applies to the migration as well: organizations can outsource a service, but they remain accountable for understanding the trust chain and confirming that dependent systems have been updated.
The article originally appeared on ComputerWorld.
