eMudhra apologises after weak security keys put eight digital certificate authorities at risk – CNBC TV18

Digital trust company eMudhra has apologised after a software scripting error left the private keys of eight intermediate digital certificate authorities vulnerable to recovery, potentially allowing attackers to create fake website certificates.

In an apology published on October 26, the company said it revoked the affected certificate authorities within 14 hours of confirming the problem. Its investigation has found no evidence that the affected authorities issued publicly trusted certificates to websites or that its systems or customer data were compromised.

“The flaw was ours,” eMudhra said, apologising to customers, partners and the wider internet security community.

The company said its digital-signature and eSign services in India and overseas, along with its enterprise applications, use separate infrastructure and were not affected.

eMudhra will replace certificates for affected customers and other customers using its TLS services at no additional cost. It also plans to publish a detailed investigation through the Common CA Database (CCADB) process and appoint an independent expert to review the incident and its security controls.

How the security flaw came to light

The issue surfaced on October 17, when a security researcher known as Wayne reported that the private keys linked to eight intermediate certificates issued by eMudhra could…

Original source: https://www.cnbctv18.com/technology/