Makes me wonder where the certs are with private keys 1-255 that weren't in these 8.

> Like, if they hadn't paid for some of the wrap/unwrap features on one of their HSM

Also depending on the FIPS configuration of their HSM, some functionality like wrap/unwrap might not be available

eMudhra is (was?) a global CA and had subsidiaries serving the US market. Your browser also doesn't have a nationalist configuration; the same browser serves people all over the world.

The problem isn't foreign companies; it's bad CAs.

Very bad argument. WebPKI and the internet are the global infrastructure. For the sake of argument, what unnecessary risk do you have in mind?

If you use the internet, yes.

If you want only to connect to the US net, stop connecting to the internet and use a US browser instead of a web browser.

Many US institutions seem to have used eMudhra as a cert provider, including Cornell, and the U of Michigan, Maryland and Chicago.

Check InCommon Certificate Service.

Until some website of some service you're using embeds an Indian-sourced JavaScript required for its support chat and you're unable to get a refund on a defective product you purchased.

Or worse, you were billed incorrectly by some US-based service, their support chat loads Indian assets, and they threaten to hit your credit score and send debt collectors after you if you don't pay up.

I hadn't heard of this Intermidate CA provider. I guess I've been a bit lax on keeping myself updated in the PKI space. That said, given the country it is based, it doesn't surprise me about the general lack of quality and seriousness about what they did and how it's been exposed.

I may get downvotes, but this just screams amateur hour.

There may be some scrutiny of Sectigo's part in this, however, they did revoke the cross-signed certs within 24 hours of acknowledging the issue: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c13

"Sectigo has completed the revocation of the affected cross-signed CA Certificates. A new CRL and OCSP responses have been published and are making their way to our CDN edge nodes right now.

We will continue monitoring and evaluating this bug for further updates from Emudhra."

They where ECC keys

Their RSA root certificate is still trusted. They could say they want that removed and the questions would instantly stop.

The browsers could kick ALL their keys out and break all of eMudhra's customers websites. Those customers could sue.

They are already attempting to flee the kitchen as quickly as they can, unfortunately the rest of the planet that's still in the kitchen isn't keen on letting them escape the grease fire they started.

If you want formal engineering outcomes, you need formal engineering standards. But in the same way that redoing a home bathroom doesn’t require the same multimillion dollar process as building a bridge, not all software projects can fall under the same umbrella. Any scheme like this has to take into account where certification is actually needed and what the goals and costs are.

And guess what: this already exists. DO-178C for aviation, ISO 26262 for automotive, IEC 62304 for medical, etc. But these standards are specialized to the industry because, no surprise, there is no appropriate one-size-fits-all software development approach. You can’t just say “software must be bug-free” and leave it at that. That’s been shown to be impossible. Even formally verified software can have spec bugs.

Accountability is rarely something that a person or organization will spontaneously adopt of their own free will. It generally has to be forced from the outside by way of additional consequences.

Right now, it would appear that the strongest external consequences for fucking up a CA are strongly-worded posts in a web forum. I would hesitate to call the wind-down of a business unit a "consequence" in this context because it's the default outcome. Everyone was already playing that game. We need an additional layer of pressure to encourage good behavior.

That's because a bridge didn't collapse.

No one at OpenAI, Anthropic or Google will be held accountable for their various felony bots[0], Facebook encouraged an actual genocide[1], but HN commenters are baying for blood of some random Indian contracting firm that royally goofed up their SSL certs.

[0] https://www.felonybench.com/

[1] https://www.amnesty.org/en/latest/news/2022/09/myanmar-faceb...

If some social media nonsense makes it hard for you to do internal investigation on the problem that shows that you're organisationally incompetent in addition to whatever else in the process failed.

> I've never been involved with a mess like this, but I can well imagine it's difficult to convene the necessary people for a dispassionate RCA when your bosses are furious and investors are screaming for scapegoats to fire.

In any sane business, the people handling the screaming investors are different from the people handling the social media mess, and they are also different from the people doing the RCA.

That said, given the mess, I wouldn't be surprised if eMudhra only had one employee responsible for all those jobs...

No it does not. How does social media upheaval make internal analysis impossible?

> I can well imagine it's difficult to convene the necessary people for a dispassionate RCA when your bosses are furious and investors are screaming for scapegoats to fire.

Such a business will not be long operating a CA, then: these sorts of requests are common and CA operations are done openly in public with all accidents openly admitted in plain view. If management can’t deliver an environment that prioritizes compliance over rage and blame, then termination of CA acceptance for the company they manage with such irrationality is a successful outcome for the process. I respect that there may be opposing corporate and/or cultural pressures, and I imagine that’s why they’re voluntarily exiting the CA business, but they’re at risk of having all issuances distrusted retroactively if they think that gives them the leeway to reply late.

That's what managers are for. They shield the people doing the work from all the external distractions.

Some of these questions shouldn't be that difficult to answer, and they were asked to provide an initial response anyways.

For example, further up in the bug tracker, they stated that there was an error in a script. If they were able to find an error, why can't they provide the script?

Those are just more reasons to remove every cert they ever touched.