On Oct. 21, a serious certificate security incident involving Indian certificate authority eMudhra came to light. Security researchers found that eight intermediate certificates issued by eMudhra had a severe key-generation flaw. Private keys that should have carried strong security properties instead contained effectively tiny values, including 4, 56, and 66, because of an implementation error. The report said security personnel could fully break those keys in less than a second.
Intermediate certificates are a critical part of the HTTPS trust chain. If their private keys can be recovered easily, attackers could forge trusted HTTPS certificates and launch man-in-the-middle attacks against banks, email providers, or any other trusted website, allowing them to intercept, alter, or steal user communications.
The root cause was described not as an external hack, but as a catastrophic implementation error in eMudhra’s certificate generation process that produced private keys with security close to zero.
Browsers and software vendors moved to block the certificates
After the issue was disclosed, major browser and software vendors rolled out emergency defenses. Chrome, Firefox, Apple, and Microsoft have all released security updates that blacklist the eight risky intermediate certificates, blocking access to forged certificates signed through them.
eMudhra has also formally revoked the affected certificates. Because many software products rely on bundled certificate trust stores, Go, Python, Rust, and Electron have also pushed urgent updates to block the impacted certificates within their own ecosystems.
No evidence of malicious use so far
As of now, global security agencies have not found evidence that the weak private keys were maliciously used to issue forged certificates. Even so, the cleanup may take time because of the large number of internet-of-things devices and older systems that may not receive updates promptly.
Security experts said the most direct protective step for users is to keep browsers and operating systems updated so they can receive the latest certificate blacklist entries in time.