/
← Voltar ao feed
high technology

eMudhra CA private keys compromised: eight intermediate certificates used trivially guessable keys, including the number 4

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 19:57 · coletado há 1 hora

Mozilla received a report on 17 October 2026 that private keys for eight eMudhra intermediate certificates were compromised. The Indian certification authority says it has issued over 60 million certificates. Researchers found some of the keys were trivially small integers, so anyone could forge HTTPS certificates for arbitrary domains and impersonate servers or intercept and modify traffic. Mozilla, Chrome and Apple have moved to distrust the affected certificates, though only once users install updates. eMudhra has revoked the certificates, but certificates signed with these keys are still in circulation. The article does not report exploitation in the wild, and eMudhra had not responded to The Register's questions.

Technical Details

  • The report reached Mozilla on Saturday 17 October at 20:06 UTC, from a community member. Dennis Jackson of Mozilla's cryptography engineering team published the disclosure.
  • Researcher Scott Helme recovered the private keys from the public certificates in under a second. One key is the number 4, others are 56 and 115. Other researchers found 66, 155, 156, 230 and 237.
  • A P-384 private key should be a random 384-bit number, roughly 2^384 possibilities. These keys are trivially guessable, so any certificate issued under them is open to forgery.
  • Cloudflare noted that an attacker can create a forged certificate for any domain.
  • Several FOSS projects have released updates that stop trusting eMudhra certificates.

Remediation

  • Update browsers and operating systems to versions that distrust the eMudhra intermediates (Mozilla, Chrome, Apple).
  • Inventory environments, including non-browser clients, services and embedded systems, for reliance on certificates chained to eMudhra, since these clients may not detect or reject the bad certificates.
  • Apply updates from FOSS projects that remove trust in the eMudhra certificates.
  • Replace affected certificates with ones from another CA and remove the eMudhra roots and intermediates from trust stores where feasible.

Linha do tempo

  1. theregister.com ↗ · pub. 20/10/2026 19:57 · coletado 20/10 20:00 primeiro registro

    eMudhra CA private keys compromised: eight intermediate certificates used trivially guessable keys, including the number 4

    ler a análise desta fonte

    Mozilla received a report on 17 October 2026 that private keys for eight eMudhra intermediate certificates were compromised. The Indian certification authority says it has issued over 60 million certificates. Researchers found some of the keys were trivially small integers, so anyone could forge HTTPS certificates for arbitrary domains and impersonate servers or intercept and modify traffic. Mozilla, Chrome and Apple have moved to distrust the affected certificates, though only once users install updates. eMudhra has revoked the certificates, but certificates signed with these keys are still in circulation. The article does not report exploitation in the wild, and eMudhra had not responded to The Register's questions.

    Technical Details

    • The report reached Mozilla on Saturday 17 October at 20:06 UTC, from a community member. Dennis Jackson of Mozilla's cryptography engineering team published the disclosure.
    • Researcher Scott Helme recovered the private keys from the public certificates in under a second. One key is the number 4, others are 56 and 115. Other researchers found 66, 155, 156, 230 and 237.
    • A P-384 private key should be a random 384-bit number, roughly 2^384 possibilities. These keys are trivially guessable, so any certificate issued under them is open to forgery.
    • Cloudflare noted that an attacker can create a forged certificate for any domain.
    • Several FOSS projects have released updates that stop trusting eMudhra certificates.

    Remediation

    • Update browsers and operating systems to versions that distrust the eMudhra intermediates (Mozilla, Chrome, Apple).
    • Inventory environments, including non-browser clients, services and embedded systems, for reliance on certificates chained to eMudhra, since these clients may not detect or reject the bad certificates.
    • Apply updates from FOSS projects that remove trust in the eMudhra certificates.
    • Replace affected certificates with ones from another CA and remove the eMudhra roots and intermediates from trust stores where feasible.