https://www.bseindia.com/xml-data/corpfiling/AttachLive/82503e00-335c-49dc-b022-f4633a08b642.pdf
https://emudhra.com/en/press-release/emudhra-to-exit-global-...
Is there some reputation left to salvage here that I'm not aware of? Who would trust them?
The technical people will just install a certbot and use the default Let's Encrypt config.
But in all honesty there are serious questions to be asked about:
a) The initial approval process for ANY CA
b) The ongoing monitoring process for ANY CA
The fact this CA was based in India ultimately has nothing to do with it if we are being completely honest here.
Clearly there is a fundamental problem with the overarching approval and monitoring process which means it could have happened anywhere. This time it just happened to be India.
Secondly, in direct reference to the "far away company" comment India does have quite strict controls on both certain technical things (speaking generally here, not specifically in relation to certs ... e.g. use of sat phones). And in general it is quite difficult (read: almost impossible) to turn up in India and do business as an external company. So there is probably a genuine need for an Indian company CA since not every body can/wants to use Let's Encrypt or whatever.
Microsoft, in particular, had strong transparency around CA approval processes that were reasonable. It was weird.
This is a sample on what it looks like during covid lockdown : https://bugzilla.mozilla.org/show_bug.cgi?id=1728790
Far away from it the default country?
Apparently they generated them like this: https://xkcd.com/221/
Surely they should be investigated by the local regulator.
https://www.deccanherald.com/india/meity-forms-team-to-probe...