The Daily PulseTechnology
Google, Apple and Mozilla block eight eMudhra certificates after weak key discovery
Reported by Sneha Patil (Staff Writer) · Livemint - Technology ·
Reported by one source so far
Photo: Wikimedia CommonsGoogle, Apple and Mozilla are blocking eight intermediate certificates issued by Indian CA eMudhra after researchers found the private keys to be dangerously weak. The flaw was reported on Oct 17 by security researcher Wayne, who said the keys had only three to eight bits of effective key space. Wayne demonstrated the issue with a site emudhra.we-have-a-problem.com that displayed a signed message, proving a malicious actor could create trusted certificates for any domain. BGP.tools director Ben Cartwright‑Cox called the situation “bonkers” and warned that example code might have slipped into production. Cloudflare announced on Oct 19 around 17:00 UTC that the compromised keys posed a serious risk and rolled out emergency patches across its CDN, developer services and Zero Trust products. The company updated its WARP, 1.1.1.1 apps and cloudflared tool, and said no active exploitation was seen on its services. The Go language maintainers released Go 1.27.3 and 1.26.10, which reject the weak keys. Google, Apple and Mozilla plan to block the certificates in Chrome, Safari and Firefox starting Oct 20. Developers and organisations have been urged to update browsers, operating systems and security applications, and to review certificate trust stores and server settings. Cryptography engineer Filippo Valsorda warned that fixing the issue could be harder than the 2014 Heartbleed bug, especially for outdated OSes, embedded devices and smart‑home products that may still trust the certificates. Certificate transparency logs show no evidence of malicious certificates issued with the weak keys, but the vulnerability could allow attackers to impersonate sites if they can position themselves between users and the real site. ## Context Weak private keys shrink the cryptographic space, making it feasible for attackers to guess them. Browsers rely on trusted certificate authorities, so any compromise can affect many users until all software is updated.
ExplainerWhy this matters
What Happened
On Oct 17 security researcher Wayne found that eight intermediate certificates from Indian CA eMudhra used private keys with only 3‑8 bits of effective security. He showed a demo site that could sign messages, proving attackers could create trusted certificates for any domain. Google, Apple and Mozilla responded by planning to block these certificates in their browsers on Oct 20, while Cloudflare and the Go language team issued emergency patches.
Why It Matters
Certificates are the backbone of HTTPS; browsers trust them to verify a site's identity. Weak keys shrink the possible key combinations, letting attackers guess the key and forge certificates. If a forged certificate is accepted, users could be tricked into entering passwords, credit‑card numbers or other personal data on a fake site that looks legitimate. The risk spreads to any device or software that still trusts the compromised certificates, including older operating systems and IoT gadgets.
What Happens Next
Users should update browsers, operating systems and any security‑related apps to the latest versions. Organisations need to check their certificate stores and replace any of the eight affected certificates. Devices that cannot be automatically updated may require manual patching or replacement. Monitoring of certificate transparency logs will continue to detect any misuse of the weak keys.
