As eMudhra Exits Cert Business, Users Face New PKI Trust Decisions (it.slashdot.org)
"As of 2026, the company has issued more than 60 million digital certificates," notes Wikipedia. But now, InfoWorld reports:
A certificate authority's decision to abandon the global SSL/TLS market is exposing a weakness many organizations rarely examine: their dependence on complex PKI trust chains. Following the compromise of private keys behind eight of its intermediate certificate authorities, eMudhra is exiting the global SSL/TLS certificate business and is offering customers Sectigo-issued replacements... [In a press note the company added] that data sovereignty and compliance requirements had increased the business's complexity and cost... The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced...
Yash Kadakia, co-founder and CTO of Security Brigade, said that moving to another root operated by the same company does not necessarily address concerns over trust and governance. "The last thing organisations need is to migrate twice," Kadakia said.
But there's another concern, the article points out. "Analysts warn that enterprises may discover they have only limited visibility into the certificate hierarchies underpinning critical services."
Replacing a website's certificate may not address every dependency in an enterprise environment, according to Sakshi Grover, research director at IDC. She said residual exposure lies in systems that maintain their own trust stores and do not update on the same schedule as browsers. These include Java keystores, language runtimes, container images, mutual TLS configurations, proxies, load balancers, VPN and security appliances, and embedded devices. "The harder finding for many organizations will be that they can't answer these questions at all," Grover said, referring to where certificate trust decisions are made outside browsers and operating systems...
Grover recommended that security teams first identify where trust decisions occur outside browsers and operating systems, prioritising systems that accept connections from external parties and mutual TLS endpoints. Teams should then determine which systems can be updated to distrust a specific intermediate certificate or public key, she said.
<p><div class="share_submission" style="position:relative;">
<a class="slashpop" href="http://twitter.com/home?status=As+eMudhra+Exits+Cert+Business%2C+Users+Face+New+PKI+Trust+Decisions%3A+https%3A%2F%2Fit.slashdot.org%2Fstory%2F26%2F10%2F25%2F0653231%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fit.slashdot.org%2Fstory%2F26%2F10%2F25%2F0653231%2Fas-emudhra-exits-cert-business-users-face-new-pki-trust-decisions%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>
</div></p><p><a href="https://it.slashdot.org/story/26/10/25/0653231/as-emudhra-exits-cert-business-users-face-new-pki-trust-decisions?utm_source=rss1.0moreanon&utm_medium=feed">Read more of this story</a> at Slashdot.</p><iframe src="https://slashdot.org/slashdot-it.pl?op=discuss&id=24133274&smallembed=1" style="height: 300px; width: 100%; border: none;"></iframe>
A certificate authority's decision to abandon the global SSL/TLS market is exposing a weakness many organizations rarely examine: their dependence on complex PKI trust chains. Following the compromise of private keys behind eight of its intermediate certificate authorities, eMudhra is exiting the global SSL/TLS certificate business and is offering customers Sectigo-issued replacements... [In a press note the company added] that data sovereignty and compliance requirements had increased the business's complexity and cost... The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced...
Yash Kadakia, co-founder and CTO of Security Brigade, said that moving to another root operated by the same company does not necessarily address concerns over trust and governance. "The last thing organisations need is to migrate twice," Kadakia said.
But there's another concern, the article points out. "Analysts warn that enterprises may discover they have only limited visibility into the certificate hierarchies underpinning critical services."
Replacing a website's certificate may not address every dependency in an enterprise environment, according to Sakshi Grover, research director at IDC. She said residual exposure lies in systems that maintain their own trust stores and do not update on the same schedule as browsers. These include Java keystores, language runtimes, container images, mutual TLS configurations, proxies, load balancers, VPN and security appliances, and embedded devices. "The harder finding for many organizations will be that they can't answer these questions at all," Grover said, referring to where certificate trust decisions are made outside browsers and operating systems...
Grover recommended that security teams first identify where trust decisions occur outside browsers and operating systems, prioritising systems that accept connections from external parties and mutual TLS endpoints. Teams should then determine which systems can be updated to distrust a specific intermediate certificate or public key, she said.
<p><div class="share_submission" style="position:relative;">
<a class="slashpop" href="http://twitter.com/home?status=As+eMudhra+Exits+Cert+Business%2C+Users+Face+New+PKI+Trust+Decisions%3A+https%3A%2F%2Fit.slashdot.org%2Fstory%2F26%2F10%2F25%2F0653231%2F%3Futm_source%3Dtwitter%26utm_medium%3Dtwitter"><img src="https://a.fsdn.com/sd/twitter_icon_large.png"></a>
<a class="slashpop" href="http://www.facebook.com/sharer.php?u=https%3A%2F%2Fit.slashdot.org%2Fstory%2F26%2F10%2F25%2F0653231%2Fas-emudhra-exits-cert-business-users-face-new-pki-trust-decisions%3Futm_source%3Dslashdot%26utm_medium%3Dfacebook"><img src="https://a.fsdn.com/sd/facebook_icon_large.png"></a>
</div></p><p><a href="https://it.slashdot.org/story/26/10/25/0653231/as-emudhra-exits-cert-business-users-face-new-pki-trust-decisions?utm_source=rss1.0moreanon&utm_medium=feed">Read more of this story</a> at Slashdot.</p><iframe src="https://slashdot.org/slashdot-it.pl?op=discuss&id=24133274&smallembed=1" style="height: 300px; width: 100%; border: none;"></iframe>
Comments