As eMudhra Exits Cert Business, Users Face New PKI Trust Decisions

"As of 2026, the company has issued more than 60 million digital certificates," notes Wikipedia. But now, InfoWorld reports: A certificate authority's decision to abandon the global SSL/TLS market is exposing a weakness many organizations rarely examine: their dependence on complex PKI trust chains. Following the compromise of private keys behind eight of its intermediate certificate authorities, eMudhra is exiting the global SSL/TLS certificate business and is offering customers Sectigo-issued replacements... [In a press note the company added] that data sovereignty and compliance requirements had increased the business's complexity and cost... The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced...

Yash Kadakia, co-founder and CTO of Security Brigade, said that moving to another root operated by the same company does not necessarily address concerns over trust and governance. "The last thing organisations need is to migrate twice," Kadakia said.
But there's another concern, the article points out. "Analysts warn that enterprises may discover they have only limited visibility into the certificate hierarchies underpinning critical services." Replacing a website's certificate may not address every dependency in an enterprise environment, according to Sakshi Grover, research director at IDC. She said residual exposure lies in systems that maintain their own trust stores and do not update on the same schedule as browsers. These include Java keystores, language runtimes, container images, mutual TLS configurations, proxies, load balancers, VPN and security appliances, and embedded devices. "The harder finding for many organizations will be that they can't answer these questions at all," Grover said, referring to where certificate trust decisions are made outside browsers and operating systems...

Grover recommended that security teams first identify where trust decisions occur outside browsers and operating systems, prioritising systems that accept connections from external parties and mutual TLS endpoints. Teams should then determine which systems can be updated to distrust a specific intermediate certificate or public key, she said.

Re:

[fuzzyfuzzyfungus]

Random intermediate CA. They got a couple of commonly used root CAs to sign for them; and everything just works from there.

Re:Who is eMudhra

[bill_mcgonigle]

This discussion on their inclusion in Mozilla is quite revealing:

https://bugzilla.mozilla.org/s... [mozilla.org]

Elsewhere it's claimed that they used a FIPS HSM to generate their keys.

I did not see who their auditor was.

Did eMudhra lie?
Did the auditor lie?
Are FIPS HSM's backdoored?
Do we have another Dual_EC_DRBG situation on our hands here?

If nobody is lying we could have just seen a huge cyberwar or false flag averted. Essential crypto gear could be totally buggered still.

PS Remember when Mozilla gave CACert absolute hell for years when they were tremendously more competent?

The HSM probably wasn't the problem

[Xenographic]

You should probably also read the ticket where eMudhra is removed [mozilla.org] because it clarifies a few things.

They're using Ultimaco HSMs, but it seems likely they weren't willing to pay the HSM vendor to unlock a feature, so they rolled their own and ended up generating the bad keys off-device and then loading them into the HSM externally. So it's less likely that the HSM itself was bad and more likely they did something insecure and dumb to be cheap. There are some pointed questions there which they've just decided not to answer so far, including things they should be able to provide like the key generation script.

Re:The HSM probably wasn't the problem

[Charlotte]

This also clarifies things (why am I not surprised):

Current situation:

        The cross-signed certs are still unrevoked
        No response from Microsoft
        CCADB still showing certificates as unrevoked

Re:

[robot5x]

I've been dealing with a Tailscale advisory recently about compromised emudhra certificates [tailscale.com]. They don't mention anything about emudhra closing shop but this can't be totally unrelated can it ??

Re: Who is eMudhra

[iabervon]

They primarily manage company-internal CAs for big businesses, which they seem to do well. AFAICT, they noticed that their security infrastructure was compliant for managing a global CA, and thought they might as well also have that as a product. However, there are some operational differences between an enterprise CA and a public one, including that companies want to issue client certs to employees but nobody really does global client certs. That means that they had an intermediate CA for global client certs that they never used, but it was in the standard trust store, and nobody tested that it was handled right until Wayne just went through the standard trust store making sure a new certificate weakness detector didn't give false positives.

So eMudhra correctly handled all the certs they issued, and all the certs they used to sign them, but they got some extra CA certs trusted that they didn't really need, because it would make their side business more similar to their main business, and this caused a major problem.

Chances are that they actually got a real random number out of a HSM for the bad CA certs, but accidentally made the certs with the index of the random number instead of the actual number. (That is, they got the 4th random number and made a cert for 4 instead of the number.) I wouldn't be surprised if they stored the correct private key, which would have made leaf certs that didn't validate because the intermediate was wrong, but they never used it to find this problem.

Re:

[93 Escort Wagon]

The educational consortium InCommon switched from Sectigo to CertiNext (backed by eMudhra) this past summer. We've had to deal with a couple stupid cock-ups at their end since then. I'm annoyed at the extra work that's upcoming, but I'm just as happy eMudhra is exiting the business.

WASF

[cellocgw]

That is all.
The current version of the famous XKCD Jenga diagram now has that teensy post consisting of a dozen teensy posts one on top of the next.

How Hard Can The Decision Be?

[SlashbotAgent]

There are dozens of major providers ranging from expensive to completely free.

How is completely striking eMudhra from your list of options or even accepted root CAs a hard decision.

Fuck them! Move on.

Re:How Hard Can The Decision Be?

[fuzzyfuzzyfungus]

That's the problem. It's relatively easy to fire a certificate issuer; but it can get surprisingly fiddly surprisingly fast to ensure that all your stuff actually distrusts one(unless you are responsible for basically nothing but a a handful of in-support major browsers and are OK with the choices their vendors make, in which case it will be handled for you relatively quickly; and was in this case). Basically any network connected widget is going to have at least one trusted root store embedded in it somewhere, possibly not updated anymore; and a number of software packages either bring their own or only partially track the OS-provided one.

You also have very little control over what other people do; both what CAs they chose to get certs from and what...questionable...partnership decisions the root CAs you do chose to trust. It's not technically secret; but unless you are practically a full-time PKI nerd you probably didn't know until after the fact that Comodo, now Sectigo, had quietly trusted eMudhra for you.

Re:

[Charlotte]

And unless you are a PKI nerd

This is Slashdot :)

Re: How Hard Can The Decision Be?

[madbrain]

I remember Diginotar, you insensitive clod.

Re:

[arglebargle_xiv]

It's relatively easy to fire a certificate issuer; but it can get surprisingly fiddly surprisingly fast to ensure that all your stuff actually distrusts one

And does that matter? This fiasco has been running since April 2025 (not April of this year, 1 1/2 years ago) and no attackers have bothered with it because the PKI isn't defending against anything they're doing. Distrust, don't distrust, it may give you a warm feeling but the attackers won't care.

Incidentally, are all your PHP setups patched?

Online security?

[Quakeulf]

4

Web of trust

[DrXym]

The way I see it is that many websites would be better off with a self signed cert than no cert at all. At least the site traffic is encrypted and a plugin like SSL lighthouse could alert the user if the cert changes.

And a site wants to add trust to their cert then they'd be better off to have their partners, customers, competitors sign their cert than some random CA that nobody has ever heard of. And it wouldn't stop CAs from signing the cert too and perhaps to gain maximum trust in a browser that might

Re:

[bn-7bc]

The problem is potential customers, ghe don't grust your ca yet and get scarry messages from their browser, and leave. This is the alure of well kniwn cas thstbare auto trusted by browser, no scary. messages and the data is encrypted in transit so less of a chance of being intercepted in transit or modified . Allso most browsers now default to HTTPS and display the same svary message if you try to access somting over https. Ie the only option you have to get a potential user to your website with no scary

Not Exactly An Improvement

[ewhac]

eMudhra is exiting the global SSL/TLS certificate business and is offering customers Sectigo-issued replacements [ ... ]

...Sectigo? Née Comodo? They haven't always been the sharpest tools [mozilla.org] in the shed, either.