Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys
The private keys associated with eight intermediate certificates issued by Indian certificate authority (CA) eMudhra have been compromised, and root programs and trust stores have started blocking them.
The certificates were issued in April 2025, and some of the compromised keys could allow attackers to generate fraudulent certificates and impersonate any website.
On October 17, Mozilla and Google blocked the certificates in Firefox and Chrome. Apple and Microsoft blocked them on October 19 and October 20, respectively. Sectigo took revocation steps too, and Cloudflare patched its services.
eMudhra revoked the compromised certificates, and the issue was communicated to downstream trust stores.
“The private keys for these certificates were generated with insufficient randomness (i.e., weak cryptographic entropy), enabling anyone to forge trusted HTTPS certificates to impersonate any website against clients that have not yet removed trust in those CAs,” Google explains.
Although the certificates have been blocked and revoked, some clients...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
