eMudhra revokes eight certificates after private keys are compromised
eMudhra, an Indian certification authority, had private keys for eight intermediate certificates compromised, putting certificates it issued at risk of being used to impersonate websites and services. The incident matters because forged certificates could let attackers intercept or alter traffic, while organisations may still rely on affected certificates.
Mozilla says it received a report on 17 October and warned that the keys could be used to issue fraudulent HTTPS certificates. eMudhra has revoked the certificates, and Mozilla, Google Chrome and Apple have taken steps to stop browsers trusting them once users update; several open-source projects have also issued updates. Security researchers found some keys were tiny numbers, including 4, 56 and 115, rather than random 384-bit values. More than 60 million certificates have been issued by eMudhra, and the company had not responded to questions about the incident at the time of publication.
- eMudhra’s weak private keys put certificates at risk.
- One compromised key was simply the number 4.
- Organisations may need to check for affected certificates.
Read the full article at the source →
Originally published by The Register as “Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’”.