Skip to main content

As eMudhra Exits Cert Business, Users Face New PKI Trust Decisions

1 week 6 days ago
"As of 2026, the company has issued more than 60 million digital certificates," notes Wikipedia. But now, InfoWorld reports: A certificate authority's decision to abandon the global SSL/TLS market is exposing a weakness many organizations rarely examine: their dependence on complex PKI trust chains. Following the compromise of private keys behind eight of its intermediate certificate authorities, eMudhra is exiting the global SSL/TLS certificate business and is offering customers Sectigo-issued replacements... [In a press note the company added] that data sovereignty and compliance requirements had increased the business's complexity and cost... The company said it will contact affected customers to replace certificates free of cost. It also said it will keep revocation and certificate status services running until every issued certificate has expired or been replaced... Yash Kadakia, co-founder and CTO of Security Brigade, said that moving to another root operated by the same company does not necessarily address concerns over trust and governance. "The last thing organisations need is to migrate twice," Kadakia said. But there's another concern, the article points out. "Analysts warn that enterprises may discover they have only limited visibility into the certificate hierarchies underpinning critical services." Replacing a website's certificate may not address every dependency in an enterprise environment, according to Sakshi Grover, research director at IDC. She said residual exposure lies in systems that maintain their own trust stores and do not update on the same schedule as browsers. These include Java keystores, language runtimes, container images, mutual TLS configurations, proxies, load balancers, VPN and security appliances, and embedded devices. "The harder finding for many organizations will be that they can't answer these questions at all," Grover said, referring to where certificate trust decisions are made outside browsers and operating systems... Grover recommended that security teams first identify where trust decisions occur outside browsers and operating systems, prioritising systems that accept connections from external parties and mutual TLS endpoints. Teams should then determine which systems can be updated to distrust a specific intermediate certificate or public key, she said.

Read more of this story at Slashdot.

EditorDavid

Getty Images Files For US Bankruptcy, Advances Restructuring Plan

1 week 6 days ago
Reuters reports: Last week, Getty announced plans to file for bankruptcy, marking a major reset after its planned merger with rival Shutterstock collapsed under the weight of heavy debt and growing competition from AI-generated imagery. Getty said the affiliates of the Getty family and Koch Equity Development, which committed to provide up to $533 million in new equity, will own 100% of the company after the restructuring It's hard to compete against things like the DALL-E image generator. Long-time Slashdot reader schwit1 quips that maybe "It's hard to compete against things like the DALL-E image generator..."

Read more of this story at Slashdot.

EditorDavid