Disgraced eMudhra drops out of TLS business after using cert private key of 4
摘要
印度证书颁发机构eMudhra宣布退出全球TLS证书业务。此前该公司签发的八个中间层TLS凭证存在严重缺陷，其中一张的私钥仅为数字4，任何人都可借此伪造任意网站或邮件服务器的证书。公司董事长表示，退出原因包括合规成本与复杂度上升、该业务仅占营收1%，以及免费TLS证书提供者的出现降低了投资回报。公司还称，社交媒体对该事件的放大引发了与其业务占比不相称的审视
eMudra, the certificate authority that issued eight intermediate TLS credentials so weak that anyone could mint certificates for any website or mail server—one had a private encryption key of just 4—said it’s getting out of the business.
V. Srinivasan, chairman of India-based eMudhra Limited, cited increasing costs and complexities of compliance requirements—paired with the business generating just 1 percent of its revenue. He also said that the emergence of organizations providing TLS certificates free of charge further reduced returns on investment when compared to other products and services the company offers.
Don't let the door hit you on the butt
“However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business,” the company continued in a Thursday post. “In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.”
转载信息
评论 (0)
暂无评论，来留下第一条评论吧