Indian Certificate Authority eMudhra Used Absurdly Weak Keys, Leaving Trust in Millions of Certificates in Doubt

Private keys used by eMudhra, a certification authority based in India, have been compromised. The company says it has issued more than 60 million digital certificates. Mozilla's Dennis Jackson reported that on Saturday, October 17, Mozilla received a report that keys linked to eight eMudhra intermediate certificates had been compromised. Those keys could let attackers issue fraudulent HTTPS certificates for websites they do not control. Cloudflare noted that an attacker could forge a certificate for any domain and use it to impersonate servers, intercepting or modifying traffic.

The keys were shockingly weak. Security researcher Scott Helme found that one private key was simply the number 4, with others being 56 and 115. He said he recovered all of them from the public certificates in under a second. eMudhra has revoked the certificates, and Mozilla, Chrome and Apple have changed their browsers so they will not rely on them, though users need to install an update. Several open source projects have also released updates to stop recognising eMudhra certificates.

The problem is not fully solved. Certificates signed with these keys are still out there, and many services rely on them. Browsers are built to detect and reject bad certificates, but other software may not be, so organisations may need to check their own environments for dependence on eMudhra certificates. Developer Geoffrey Huntley has offered advice on automating that check. At the time of writing, eMudhra had not responded to The Register's questions.