eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable: The Hacker News Research

Executive Summary

According to security intelligence published by The Hacker News, eMudhra, an Indian certificate authority (CA), will withdraw from its global SSL/TLS certificate business, its board decided on Thursday. The decision came five days after a researcher reported recovering the private keys of eight of its intermediate CA certificates.

eMudhra said it will replace affected customers' certificates with free ones from partners, though its announcement did not name the partners or provide a date for the exit.

Six of those eight were for website (TLS) certificates. Chrome will stop trusting the eMudhra root certificate above them, emSign ECC Root CA - G3. The change is expected to reach users on the morning of October 27, Pacific time.

Technical Context

Modern web infrastructure requires continuous validation of certificate lifecycle states and cryptographic configurations. Security advisories from The Hacker News emphasize the necessity of proactive endpoint audits and disciplined configuration management.

Key Considerations for Infrastructure Teams

• Cryptographic Agility: Regularly audit active cipher suites and certificate configurations to eliminate deprecated primitives.
• Automated Revocation & Lifecycle Monitoring: Track certificate renewal deadlines and revocation notices across all operational environments.
• Endpoint Verification: Verify that service endpoints correctly present full certificate chains to prevent handshake failures.

Recommended Mitigation Steps

1. Audit active public endpoints for certificate expiration deadlines within the next 30 days.
2. Verify that automated renewal hooks reload web server configurations upon certificate issuance.
3. Configure real-time rogue certificate detection across your domain names.

Editorial Notice: This bulletin is an independent editorial summary based on reporting and disclosures published by The Hacker News. CertificateGuardian curates industry intelligence to assist infrastructure teams in securing web endpoints.