eMudhra pulled 8 more certificate issuers after a coding error, and Microsoft drops its remaining roots November 16. Site owners should check their certificates.
eMudhra, a company that sells website and software certificates under the emSign brand, has revoked 8 more of its certificate issuers. Last month it said they were safe. Now it says it cannot prove their keys were handled the way its own rules require. The cause is the same in-house script that weakened 8 other keys in October.
A certificate issuer, called a certificate authority, vouches that a website or program is genuine. Each one signs certificates with a private key, which works like a master stamp. In October, a single line in eMudhra's script cut each of 8 such keys down to one byte. That made them far weaker than they should be.
The company posted on October 19 that the other 8 issuers, which use a different kind of key, were not affected. It has now reversed that. Its full report says those keys passed through the same step of the script.
The script did not weaken these keys, and their signatures still check out. But parts of the private keys sat in the memory of a Python process on a ceremony computer. Logs and files from that computer cannot reliably show how the material was handled. The company says it cannot demonstrate it followed its own rule for moving keys in and out of secure hardware.
The 8 were revoked late last week. Some people in the public discussion have asked why the company used the reason code cessationOfOperation instead of keyCompromise.
Of the 8 issuers, 6 were for website certificates and 2 for code signing. The company lists 195 certificates from them. Of those, 29 are for its own domains. The rest name several universities and colleges, a county and other organizations. The company says all holders now have new certificates.
A bigger change arrives soon. Microsoft will start removing the 10 remaining eMudhra roots on November 16. Certificates that chain to those roots will then lose default trust in Windows and Edge.
The company knows of no case of misuse. Browsers that enforce Certificate Transparency, a public record of issued certificates, could not have been fooled by the weak October keys. Whether anyone used them against software that skips that check is not known. The company also says the risky key-moving process was used only once.
If you run a website or sign software, the steps in the box above walk through checking your certificate and replacing it before November 16.
KPMG, an independent reviewer hired by the company, is due to finish by December 4. The company's inventory of all its issuer keys is due November 30. It is also exiting the publicly trusted website certificate business. Some people in the discussion want the script published and are asking how private keys could leave the secure hardware at all.
If your site or software uses an eMudhra or emSign certificate, replace it with one from another provider before Microsoft drops trust on November 16.
Three men were arrested for allegedly using AI to fake executives and lawyers, and prosecutors say they took more than $129 million from companies worldwide.
Read more: Three men arrested for using AI fakes to steal $129 millionA former Premise Health employee copied patient files, including Social Security numbers. Letters are going out, and two other health firms reported breaches.
Read more: Former Premise Health employee copied patient records, including SSNsA flaw hidden in OpenSSH for about a decade lets attackers into some locked Linux accounts with an oversized password. Check whether your servers are affected.
Read more: Decade-old flaw lets attackers in with an oversized password
