Abstract:
Indian digital certification infrastructure company eMudhra recently issued a response to the issue of certificate investigation reports. The grassroots company actually believed that social media review, investor and customer analysis prevented the team from conducting meaningful investigations. This response immediately caused dissatisfaction among Google employees. Both Google employees and Mozilla Foundation employees accused eMudhra of trying to shirk responsibility.
In the Bugzilla discussion thread, industry stakeholders requested eMudhra to release the accident investigation report as soon as possible. However, eMudhra delayed the release of the investigation report many times. The reason given was that social media and industry attention prevented the company from conducting a meaningful investigation.
Subsequently, members of the Google Root Certificate Project commented that public attention was a foreseeable consequence of the incident and that public attention should not be used as a reason to delay response. Mozilla Foundation employees also share Google's concerns and require eMudhra to fulfill its responsibilities to the community.
Public discussion may indeed put pressure on eMudhra, but this will not prevent the company from continuing to examine key generation scripts, various records and hardware security module logs. eMudhra directly links external scrutiny with the inability to investigate, making it easy for people to think that eMudhra is first concerned about the public opinion environment rather than producing an accident investigation report that can be reviewed as soon as possible.
In the discussion thread, Google and the Mozilla Foundation raised the following questions about this certificate incident: What specifically went wrong in the key generation process, why they did not continue to pursue it when it was discovered in 2025 that the CRL signature did not match the certificate, and why the existence of a second set of keys was not stated in previous incident reports.
These questions require scripts, operational records, and timelines to answer. The CA business is the cornerstone of global Internet security. eMudhra’s irresponsible approach has made the industry very dissatisfied.
It is worth noting that eMudhra has previously announced its withdrawal from the global TLS/SSL certificate business. However, in its withdrawal statement, eMudhra emphasized that the certificate business accounts for less than 1% of the company's revenue, and this security incident has had a serious impact on the company's reputation.
It can be seen that what this Caotai company really cares about is not the issue of Internet security, but whether it can make money and how to abandon the car to save the handsome in the current situation. Although eMudhra emphasized that a detailed investigation report would be released later, considering that eMudhra has decided to run away, no one knows whether the investigation report released later will be detailed enough.
Related articles:
Enthusiasts use eMudhra leaked certificates to issue 106,000 certificates for Google, which can pass CA public key certification
Comments