Updated Urgent Advisory: Action Required by Monday, Nov. 16 for InCommon eMudhra/emSign Certificates on TSE

Informational

Updated Urgent Advisory: Action Required by Monday, Nov. 16 for InCommon eMudhra/emSign Certificates on TSE

Status: in progress
Date:
Affected Components:
TSE On Premise
Update

What’s changed

Microsoft has removed several eMudhra root certificates from the Windows and Microsoft Edge trust lists. The change follows a compromise of eMudhra certificate authority keys (Microsoft’s announcement). InCommon certificates issued through eMudhra (emSign) will stop being trusted on Windows devices once those updates reach them.

This replaces our November 11 guidance to keep your current certificate. If your certificate was issued through eMudhra/emSign, you need to replace it.

Who needs to act

TSE clients whose InCommon certificate was issued through eMudhra/emSign.

To check, open the certificate chain on your TSE server. If eMudhra or emSign appears anywhere in the issuer chain, you’re affected.

If your InCommon certificate is Sectigo-based and isn’t expiring soon, you’re OK. Keep using it, and don’t renew or replace it until the TSE update is available. If it’s expiring soon, follow one of the options below.

What to do by Monday, November 16

A TSE update that supports InCommon’s new SSL.com certificates is at least one to two weeks away. Until then, choose one of these options:

  • Option 1: Buy a TLS certificate from GoDaddy and install it on your TSE server.
  • Option 2: Get a new InCommon certificate (now issued through SSL.com), then:
    • Build the cross-signed certificate chain to “SSL.com EV Root Certification Authority RSA R2” so PR5000 readers and Verify devices keep working. Your completed chain should look like this (see photo below):
      1. SSL.com EV Root Certification Authority RSA R2
      2. SSL.com TLS RSA Root CA 2022
      3. SSL.com TLS Issuing RSA CA R1
      4. Your server certificate
    • Contact Illumia Support to get the loaner server.pem, then install it on your TSE server. This is needed for host monitor and legacy devices.
  • Option 3 (TSE 4.1.9.2 or later only): Get a Let’s Encrypt certificate and install it on your TSE server. No other steps are needed.

Next steps

We’ll post to Statuscast when a TSE update that supports SSL.com certificates is available.

Questions or need help? Open a case via Illumia Connect or call 888-381-8054, Option 1.

For the latest information, visit https://status.illumiatech.com