eMudhra intermediate CA compromise
https://news.ycombinator.com/item?id=50166579
1271 points | galadran | 3 days ago | 504 comments
--
Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds
https://news.ycombinator.com/item?id=50177916
935 points | hkc | 2 days ago | 460 comments
--
eMudhra to exit global SSL/TLS certificate business
https://news.ycombinator.com/item?id=50195110
1111 points | bo0tzz | 1 day ago | 713 comments
> There are a lot of questions here. As most of you can imagine, we have been subject to intense social media scrutiny and analysis by investors/customers over the last few days and it has made doing any meaningful analysis of the event pretty much impossible. The event happened on April 30 2025 and was done by set of people who have worked in the PKI industry for several years and worked with us for a while. There is a lot of digging we need to do to understand the circumstances, why, what, how to share a meaningful report that can hopefully benefit the community. I do not know why some community members think we wont be getting back on this bug. When we signed up for the browser program trust, we also signed up for disclosure obligations to the community which we will uphold.
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c39
ETA- HN rate-limiting won't let me reply, but to the commenter asking how all the pressure could delay a sober analysis:
I've never been involved with a mess like this, but I can well imagine it's difficult to convene the necessary people for a dispassionate RCA when your bosses are furious and investors are screaming for scapegoats to fire.
"Sectigo has completed the revocation of the affected cross-signed CA Certificates. A new CRL and OCSP responses have been published and are making their way to our CDN edge nodes right now.
We will continue monitoring and evaluating this bug for further updates from Emudhra."
[0] https://www.felonybench.com/
[1] https://www.amnesty.org/en/latest/news/2022/09/myanmar-faceb...
Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum. I would hesitate to call the wind-down of a business unit a "consequence" in this context because it's the default outcome. Everyone was already playing that game. We need an additional layer of pressure to encourage good behavior.
The problem isn't foreign companies; it's bad CAs.
If eMudhra just don't comply with Mozilla/Chrome, is there anything they can actually do?
And the discussion mentioning wrap/unwrap testing kind of feeds directly into the fear that either:
1. These weak keys were created outside the HSM and then imported.
2. These weak keys were meant to be the wrap keys somehow. Like, if they hadn't paid for some of the wrap/unwrap features on one of their HSMs and so were using easy-for-humans keys to handle the wrap/unwrap operations so they could more easily move keys between HSMs.
Also depending on the FIPS configuration of their HSM, some functionality like wrap/unwrap might not be available
I mean if I'm going to make really large generalizations about Software Engineering talent by country, Swiss people are the absolute bottom of the barrel maybe followed by the cheap outsourcing countries next, but ymmv.
I'm also sure i've worked with a lot more very good Indian engineers than German engineers here in America, but that might have more to do with who immigrates here.
By virtue of population, a generalization may or may not hold more weight. Anecdotes are also tricky to really apply broadly: it's simply impossible for you to have encountered that many Swiss software engineers because few exist, because few Swiss people exist. In 2019, for instance, there were over 300,000 Indian H-1B petitions, to Switzerland's total of 202.
> I'm also sure i've worked with a lot more very good Indian engineers than German engineers here in America, but that might have more to do with who immigrates here.
Relative quality of life in Germany is objectively better in India by pretty much every metric, so there's an automatic/inherent bias in any immigrants you encounter. (More than 10% of the Indian population doesn't have access to modern toilet facilities, for instance.) The competition for U.S. immigrant visas is far higher amongst Indians simply by the numbers, so there may be a filtering function at play.
Something that could have been fully analyzed with those people in a couple weeks ending up taking two years with an independent outside auditor.
The independent auditor would have been needed either way, but if we gave the original crew the opportunity to respond, THEN fired them, the outside auditor could have just verified the story much more quickly.
That just sounds like a management failure. You don’t actually have to cave.
In any sane business, the people handling the screaming investors are different from the people handling the social media mess, and they are also different from the people doing the RCA.
That said, given the mess, I wouldn't be surprised if eMudhra only had one employee responsible for all those jobs...
Such a business will not be long operating a CA, then: these sorts of requests are common and CA operations are done openly in public with all accidents openly admitted in plain view. If management can’t deliver an environment that prioritizes compliance over rage and blame, then termination of CA acceptance for the company they manage with such irrationality is a successful outcome for the process. I respect that there may be opposing corporate and/or cultural pressures, and I imagine that’s why they’re voluntarily exiting the CA business, but they’re at risk of having all issuances distrusted retroactively if they think that gives them the leeway to reply late.
For example, further up in the bug tracker, they stated that there was an error in a script. If they were able to find an error, why can't they provide the script?
It would seem that we have different definitions of "wind-down". Everyone in the business operated with this consequence already on the table and it did not seem to provide the desired outcome.
No, the strongest consequence is their stock value. It has gone down a lot and if they continue not following their agreed obligations as shown I hope that trend will continue.
And guess what: this already exists. DO-178C for aviation, ISO 26262 for automotive, IEC 62304 for medical, etc. But these standards are specialized to the industry because, no surprise, there is no appropriate one-size-fits-all software development approach. You can’t just say “software must be bug-free” and leave it at that. That’s been shown to be impossible. Even formally verified software can have spec bugs.
man fox news has really done a number on people's brains.....
Or worse, you were billed incorrectly by some US-based service, their support chat loads Indian assets, and they threaten to hit your credit score and send debt collectors after you if you don't pay up.
Check InCommon Certificate Service.
If you want only to connect to the US net, stop connecting to the internet and use a US browser instead of a web browser.
IcePenguin•1h ago
> "There are a lot of questions here. As most of you can imagine, we have been subject to intense social media scrutiny and analysis by investors/customers over the last few days and it has made doing any meaningful analysis of the event pretty much impossible."
Mozilla Root Program's update, stating that eMudhra has not responded to investigatory questions within deadlines (and had provided an extension): https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c42
> "The Mozilla Root Program sent the attached questions to eMudhra on the 20th October at 20:31 UTC. eMudhra was asked to provide an initial response within 24 hours. After the deadline passed on October 21st, eMudhra asked for a further 24 hours to respond. As of the time of writing on Friday 23rd, Mozilla has not received a response to these questions."
jmspring•49m ago
I may get downvotes, but this just screams amateur hour.
dsr_•39m ago
moi2388•35m ago
rei_xd•26m ago
15155•30m ago
Do some countries possibly value quality or responsibility as a desirable property more than others at a cultural level? (Is "German Engineering" a real thing?)
Why do 419-style scams seem to emanate from a few specific countries? Why is piracy on the high seas more prevalent in Somalia than the United Kingdom?
lukan•18m ago
It is, but those generalisations are usually debatable and will then lead to nationalistic debates that are allmost always flame war style, with people shouting over each other who is from the worst nation. Which is why many flag anything, that smells like leading towards this.
VirusNewbie•