The security of eight intermediate certificates from eMudhra, a prominent Indian certificate authority, has been compromised, prompting significant responses from major web browsers and security platforms. The breach involved the private keys of these certificates, leading to concerns over potential misuse.
Browser Actions in Response to Breach
The compromised certificates, issued in April 2025, posed a risk of enabling attackers to create fraudulent certificates, thus impersonating any website. In response, Mozilla and Google were the first to block these certificates on October 17, followed by Apple and Microsoft on October 19 and 20, respectively. Additionally, Sectigo revoked the certificates, and Cloudflare took necessary measures to secure its services.
Details of the Cryptographic Issue
eMudhra took steps to revoke the compromised certificates and informed relevant trust stores. Google clarified that the private keys lacked sufficient randomness, or cryptographic entropy, enabling them to be forged for trusted HTTPS certificates, which could be exploited by clients yet to update trust settings. Despite revocation, certain clients might need software updates to effectively distrust these intermediates.
Technical Insights and Future Measures
Dennis Jackson from Mozilla developed a tool to verify if clients continue to trust the compromised certificates. He highlighted that the private keys were incorrectly generated, making them easily retrievable. According to Jackson, several individuals have independently retrieved these keys due to their weak structure, recoverable using the baby-step giant-step discrete log algorithm.
There’s no substantial evidence from Certificate Transparency (CT) logs of the keys being misused before revocation. However, not all clients enforce CT, posing a risk for potential impersonations. eMudhra admitted that a flaw in the script used during their key generation process resulted in a weaker key pair, unintentionally used for certificate signing requests.
eMudhra’s Response and Future Outlook
eMudhra stated that the compromised issuers were intended for specific international data centers addressing data sovereignty concerns but were never fully operational. The company acknowledged human errors and is now investigating code flaws and process gaps. eMudhra plans to reverify all previous key ceremonies to ensure robust security protocols.
This incident highlights the critical importance of stringent cryptographic standards and monitoring to prevent similar vulnerabilities in the future, emphasizing ongoing vigilance in cybersecurity practices.
