National Informatics Centre comes under dark cloud

New Delhi: The government on Monday said it is looking into the matter raised by tech giants Google and Microsoft which have said that the National Informatics Centre (NIC) has issued unauthorised digital certificates.

The Controller of Certifying Authorities issues licences and regulates the working of Certifying Authorities, who issue digital certificates for electronic authentication of users. Digital certificate is like an electronic passport that allows a person, computer or organisation to securely exchange information over the internet.

When contacted, department of electronics and information technology secretary R. S. Sharma said, “We are looking into this issue. Certifying Authority (CA) is taking appropriate steps and is working under the guidance of the CCA.”

In a blog post last week, Google said, “On Wednesday, July 2, we became aware of unauthorised digital certificates for several Google domains. The certificates were issued by NIC of India, which holds several intermediate CA certificates trusted by the Indian Controller of Certifying Authorities (India CCA).”

Similarly, Microsoft said it is aware of improperly issued SSL certificates that could be used in attempts to spoof content, perform phishing attacks or perform man-in-the-middle attacks.

“SSL certificates were improperly issued by NIC, which operates subordinate CAs under root CAs operated by Government of India’s Controller of Certifying Authorities, which are CAs present in the Trusted Root Certification Authorities Store,” it added.

Meanwhile, CCA in a post on its website said, “Due to security reasons 3 CA Certificates issued to NICCA have been suspended and the corresponding CRLs have been updated for this purpose. Further updation will be notified.”

Google said it had alerted NIC, India CCA and Microsoft about the incident and blocked the mis-issued certificates in Chrome with a CRLSet push. “On July 3, India CCA informed us that they revoked all the NIC intermediate certificates and another CRL Set push was performed to include that revocation.” The US-based firm said India CCA informed it about the results of their investigation on July 8.

“They reported that NIC's issuance process was compromised and that only four certificates were misissued, the first on June 25. The four certificates provided included three for Google domains (one of which we were previously aware of) and one for Yahoo domains,” Google added.

Digital certificate provides identifying information, and is forgery resistant and can be verified. It contains certificate holder’s name, a serial number, expiry dates, a copy of certificate holder’s public key (used for encrypting messages and digital signatures) and digital signature of the CA so that a recipient can verify the certificate.