Browsers and Trust Stores Block eMudhra Intermediate Certificates After Private Keys Recovered
Summary
Weakly generated private keys for eight eMudhra intermediate certificates were recovered, risking fraudulent website certificates. Major browsers and trust stores blocked them; eMudhra revoked them. No malicious use was found in Certificate Transparency logs.
Key points
- Eight intermediate certificates issued by eMudhra in April 2025 had private keys generated with insufficient randomness; the keys could be recovered quickly.
- The keys could enable fraudulent trusted HTTPS certificates and website impersonation on clients that still trust the compromised intermediates.
- Mozilla and Google blocked the certificates on October 17; Apple and Microsoft followed on October 19 and 20. Sectigo also took revocation steps, and Cloudflare patched its services.
- eMudhra revoked the certificates and attributed the issue to a script flaw that generated a weaker key pair, which was mistakenly used for certificate signing requests.
- No malicious use was evident in Certificate Transparency logs before revocation, but the article notes that not all clients enforce CT.
- Some clients may need software updates to stop trusting the intermediates; Mozilla's Dennis Jackson published a tool to check trust status.
Article Details
- Event Type
- Compromise of private keys for eight eMudhra intermediate certificates, followed by certificate revocation and blocking by browser and trust-store programs.
- Impact
- The weakly generated keys could be recovered and used to create fraudulent HTTPS certificates to impersonate websites for clients that still trusted the compromised intermediates. The article reports no evidence in Certificate Transparency logs of malicious use before revocation, while noting that not all clients enforce Certificate Transparency. Some clients may need software updates to stop trusting the certificates.
People
Vendors
AppleApple and Microsoft blocked them on October 19 and October 20, respectively.CloudflareSectigo took revocation steps too, and Cloudflare patched its services.eMudhraThe private keys associated with eight intermediate certificates issued by Indian certificate authority (CA) eMudhra have been compromised, and root programs and trust stores have started blocking them.GoogleOn October 17, Mozilla and Google blocked the certificates in Firefox and Chrome.MicrosoftApple and Microsoft blocked them on October 19 and October 20, respectively.MozillaOn October 17, Mozilla and Google blocked the certificates in Firefox and Chrome.SectigoSectigo took revocation steps too, and Cloudflare patched its services.