Overview
- Researchers reported on Oct. 17 that eight intermediate certificate private keys created by eMudhra were trivially weak and could be recovered from the public certificates.
- The weak keys were tiny integers rather than strong random numbers, which allowed multiple security teams to reconstruct every key in under a second.
- Six of the affected intermediates were for TLS and two were for code signing, and browsers including Mozilla, Chrome, Apple and Microsoft quickly blocked or distrusted them while eMudhra revoked the intermediates.
- Google plans to remove eMudhra’s emSign ECC Root CA-G3 from Chrome on Oct. 27, and vendors and libraries such as Go, Python and Cloudflare have issued updates to reduce browser-based exposure.
- MeitY/CERT-In have opened an official probe, eMudhra is winding down its global SSL/TLS business to transition customers, and systems that do not get updated—embedded devices, bespoke apps and some server toolchains—remain at risk.