Looking into unauthorised digital certificates issue: Govt

Tags: News
The government today said it is looking into the matter raised by tech giants Google and Microsoft which have said that the National Informatics Centre (NIC) has issued unauthorised digital certificates.

The Controller of Certifying Authorities issues licences and regulates the working of Certifying Authorities, who issue digital certificates for electronic authentication of users.

Digital certificate is like an electronic passport that allows a person, computer or organisation to securely exchange information over the Internet.

When contacted, Department of Electronics and Information Technology Secretary R S Sharma told PTI: "We are looking into this issue. Certifying Authority (CA) is taking appropriate steps and is working under the guidance of the CCA."

In a blog post last week, Google said: "On Wednesday, July 2, we became aware of unauthorised digital certificates for several Google domains.

"The certificates were issued by NIC of India, which holds several intermediate CA certificates trusted by the Indian Controller of Certifying Authorities (India CCA)."

Similarly, Microsoft said it is aware of improperly issued SSL certificates that could be used in attempts to spoof content, perform phishing attacks or perform man-in-the-middle attacks.

"SSL certificates were improperly issued by NIC, which operates subordinate CAs under root CAs operated by Government of India's Controller of Certifying Authorities, which are CAs present in the Trusted Root Certification Authorities Store," it added.

Meanwhile, CCA in a post on its website said: "Due to security reasons 3 CA Certificates issued to NICCA have been suspended and the corresponding CRLs have been updated for this purpose. Further updation will be notified."

Google said it had alerted NIC, India CCA and Microsoft about the incident and blocked the mis-issued certificates in Chrome with a CRLSet push. "On July 3, India CCA informed us that they revoked all the NIC intermediate certificates and another CRLSet push was performed to include that revocation."

The US-based firm said India CCA informed it about the results of their investigation on July 8.

"They reported that NIC's issuance process was compromised and that only four certificates were misissued, the first on June 25. The four certificates provided included three for Google domains (one of which we were previously aware of) and one for Yahoo domains," Google added.

Digital certificate provides identifying information, and is forgery resistant and can be verified.

It contains certificate holder's name, a serial number, expiration dates, a copy of certificate holder's public key (used for encrypting messages and digital signatures) and digital signature of the CA so that a recipient can verify the certificate.

EDITORIAL OF THE DAY

  • Mergers apart, Sebi must also allow fund houses to offer diverse products

    The Securities and Exchange Board of India’s (Sebi’s) reported push for merger of open-ended mutual fund schemes is a logical step, as there is li

FC NEWSLETTER

Stay informed on our latest news!

TODAY'S COLUMNS

Arun Nigavekar

Can Hefa actually become a reality?

The ministry of human resource development (MHRD) is actively wo­rking ...

Rajgopal Nidamboor

Creativity is that divine luminosity

Creativity or ingenuity, isn’t a licence limited to ‘functioning’ minds ...

Dharmendra Khandal

No one's getting rich overnight by poaching

We often read in newspapers that tiger skin worth Rs ...

INTERVIEWS

William D. Green

Chairman & CEO, Accenture