Weak eMudhra certificates put web trust under pressure
Browser makers block eight certificates after researchers discover extremely weak private keys.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Eight intermediate certificates from the Indian certificate authority eMudhra have been revoked or blocked after their private keys were found to contain insufficient randomness. As a result, attackers could theoretically create forged HTTPS certificates for arbitrary websites.
Google reported on Tuesday that it received a report about the certificates on 17 October. According to the company, the private keys had been generated so weakly that someone could have forged trusted certificates with them. An attacker could thereby impersonate a website and intercept or alter encrypted traffic.
The certificates were part of eMudhra’s public certificate chain. Such intermediate certificates may issue certificates for websites on behalf of a trusted root certificate authority. According to Google, the problem was not a general failure of HTTPS, but lay in these specific keys.
Chrome blocked the affected keys through a rapid revocation list. Google also says it will remove the parent root certificate from the Chrome Root Store. According to the company, that change is expected to be rolled out on 27 October to devices that use this store. Websites still using a certificate in this chain must therefore switch to another certificate chain.
Firefox also blocked the eight certificates through its OneCRL system. Mozilla additionally released updates for users who do not have automatic revocation updates available. Cloudflare says it has adjusted its own services and reports that it has found no active exploitation of the problem within its infrastructure.
The direct consequences therefore appear to lie mainly with administrators of websites and systems that have not yet been updated. Google says that, before the blocking, no certificates linked to six of the affected intermediate certificates had been registered in Certificate Transparency. That log makes the issuance of public certificates verifiable, but does not provide a full guarantee for every possible use.
eMudhra says the incident is being investigated and is limited to the eight certificates. According to the company, the root private keys were not affected and only one of the intermediate certificates has ever been used in production. None of the affected certificates is said to have issued end-entity certificates for websites, eMudhra says. That statement is based on internal investigation and public records; the broader cause of the error has not yet been established.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The core claims have been confirmed by Google, Cloudflare and eMudhra. Uncertainties about the precise cause and any exploitation are explicitly described as questions under investigation.
- confirmed Eight eMudhra intermediate certificates had compromised or extremely weak private keys. — Google and eMudhra describe the eight affected certificates and the weak key generation. source
- confirmed Google and Firefox blocked the affected certificates. — Google describes the CRLSet block; eMudhra summarises the Firefox block and Mozilla updates. source
- confirmed No public end-entity certificates issued by the affected certificates were found. — eMudhra reports this on the basis of internal analysis and public Certificate Transparency data; Google confirms that no certificates were registered for six intermediate certificates. source
- confirmed Cloudflare found no active exploitation within its services. — Cloudflare reports this in its incident description. source
- confirmed The Chrome Root Store is removing the parent root certificate and expects to roll out that change on 27 October. — Google explicitly mentions this date and measure. source
Editor's note
The blocks and the absence of known issued end-entity certificates have been described by multiple technical parties. The cause of the weak key generation and the question of whether exploitation occurred anywhere outside Cloudflare are still under investigation.Sources
- Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates — Google Security Blog
- 8 eMudhra certificates are compromised. Here's what you need to know — Cloudflare
- eMudhra Statement on Recent Certificate Security Incident — eMudhra
- The Internet goes on high alert after discovery of 8 compromised TLS certs — Ars Technica
More on this in Dutch media
- Het Parool — „cybersecurity https”
- NRC — „cybersecurity https”
- Tweakers — „cybersecurity https”