eMudhra Private Keys Compromised, Threatening 60 Million Digital Certificates
Mozilla confirms eight intermediate certificate keys from Indian CA eMudhra were exposed, allowing potential impersonation of any domain using its services.
Key points
- Eight private keys for eMudhra intermediate certificates were compromised on October 17, 2024.
- Over 60 million digital certificates issued by eMudhra can no longer be trusted.
- Major browser vendors including Mozilla, Chrome, and Apple have issued updates to reject these certs.
Mozilla announced on Tuesday that private keys associated with eight intermediate certificates from Indian certification authority eMudhra had been compromised. The exposure, reported on October 17, means attackers could create fraudulent HTTPS certificates for any domain, enabling them to impersonate legitimate servers and intercept or modify traffic.
Dennis Jackson, a member of Mozilla’s cryptography engineering team, detailed the incident in a public post. He stated that Mozilla received the initial report from a community member at 20:06 UTC on Saturday, October 17. The compromised keys allow for the creation of forged certificates, which undermines the trust chain for all services relying on eMudhra-issued credentials.
Vendor Response and Browser Updates
Major technology companies have moved quickly to mitigate the risk. Mozilla, Google Chrome, and Apple have all released updates that prevent their browsers from trusting certificates signed by the compromised eMudhra keys. Users must install these updates to ensure their browsers reject the fraudulent credentials. Jackson noted that eMudhra has revoked the affected certificates, though the broader cleanup effort remains ongoing.
The response has extended beyond major browser vendors. Many open-source projects have issued updates to ensure their software no longer recognizes certificates from eMudhra. According to Jackson, this widespread remediation helps contain the immediate threat to end-user browsing experiences. However, the presence of compromised keys still poses significant risks to other systems that may not have yet implemented similar blocks.
Scope of the Affected Certificates
eMudhra claims to have issued over 60 million digital certificates, positioning itself as a key player in establishing digital trust. The compromise of its intermediate keys affects the integrity of all certificates signed with those specific keys. Cloudflare described the severity of the flaw, noting that an attacker could forge a certificate for any domain to impersonate servers.
Despite the revocation of the certificates, many signed with the compromised keys remain in use across various services. Browser makers are designed to detect and reject bad certificates automatically. Other services and internal systems that relied on these certificates may not have the same automated detection capabilities, leaving them vulnerable to exploitation until they audit their environments.
What should you do?
Organizations and security professionals should immediately verify if their infrastructure relies on certificates issued by eMudhra. Developer Geoffrey Huntley has provided advice on automating the process of identifying these certificates within complex environments. Since no fix has been confirmed for all potentially affected systems, manual auditing may be necessary for legacy or isolated networks that do not receive automatic browser updates.
What to do and how to stay safe: eMudhra
- Audit your server and client configurations to identify any certificates issued by eMudhra.
- Ensure all web browsers and operating systems are updated to the latest versions that reject eMudhra certificates.
- Monitor network traffic for unusual certificate validation errors or unexpected connections to compromised domains.
- Consult with your certificate management team to replace any eMudhra-issued certificates with those from a trusted provider.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which certification authority had its private keys compromised?
The Indian certification authority eMudhra had eight intermediate certificate private keys compromised.
How many certificates are potentially affected by this breach?
eMudhra has issued over 60 million digital certificates, all of which can no longer be trusted if signed with the compromised keys.
Have major browsers issued updates to address this issue?
Yes, Mozilla, Chrome, and Apple have released updates to prevent their browsers from trusting the compromised eMudhra certificates.
