security

Massive clean-up job under way because this mess makes it possible to impersonate any website or service

Tragically simple private keys used by a certification authority based in India have been compromised, meaning the 60-million-plus certs it has issued can’t be trusted and necessitating a massive clean-up job.

The CA of concern in this case is called eMudhra, which boasts of having issued over 60 million digital certificates to help usher in a world of digital trust.

The company has instead panicked the world.

News of the company’s errors appeared on Tuesday in a post by Dennis Jackson, a member of Mozilla’s cryptography engineering team.

“On Saturday, October 17, at 20:06 UTC, Mozilla received a report from a community member that private keys associated with eight eMudhra intermediate certificates had been compromised,” he wrote .…