Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates
Former certification authority eMudhra has claimed a buggy Python script is the main reason it issued laughably insecure digital certificates.
Key points
- Kumar’s new post lists three steps eMudhra will take to wind up its certification business, one of which will see the company “Put in place improvements motivated by findings of [an] independent review to strengthen our general PKI operations.” Sounds like a plan.
- The plan went sour when the company didn’t notice the errors in its script and didn’t test the keys it created.
- Browser-makers quickly tweaked their software so it would not recognize certs from eMudhra.
The rest is history: a Mozilla team member noticed that the company’s keys were woefully weak and pointed out that attackers could therefore issue fraudulent certificates that allowed them to impersonate servers, observe traffic, or even modify data in transit.
Additional details
- It therefore used HSMs made by a company called Utimaco to generate keys and planned to transfer the keys it produced to a different set of HSMs from a company called Crypto4A.
- The Indian business then quit the SSL/TLS certification business, which it said was never a major source of revenue but had suddenly become a severe source of embarrassment.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 1 article from 1 outlet
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.