eMudhra Revokes 8 More CAs It Previously Declared Unaffected by Key Compromise
Overview
eMudhra has revoked eight of its intermediate certificate authorities (CAs) following a key compromise incident in October. Initially, the company believed these CAs were unaffected, but a flaw in an internal Python script led to their revocation. Each CA has its own private key, which is used to sign the certificates eMudhra issues. Although the keys themselves were not compromised, the issue with the script raised concerns about the integrity of the certificates. This situation affects users relying on eMudhra's certificates for secure communications, highlighting ongoing challenges in certificate management and security practices.
Key Takeaways
- Affected Systems: eMudhra intermediate certificate authorities
- Timeline: Disclosed on October 2023
Original Article Summary
The in-house Python script behind eMudhra's October key compromise has now cost the company 8 more of its intermediate certificate authorities (CAs), even though it did not weaken their keys. Each intermediate CA has its own private key, which the company uses to sign the certificates it issues. The 8 intermediate CAs compromised in October had a different problem: a single line in the script
Impact
eMudhra intermediate certificate authorities
Exploitation Status
No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.
Timeline
Disclosed on October 2023
Remediation
Not specified
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.