eMudhra Intermediate Certificate Keys Leak, Major Tech Firms Block Certificates
Google's Chrome Root Program, Mozilla, Apple, Cloudflare and the Go Project blocked the eight compromised certificates and released patches, urging users to update.
Private keys for eight intermediate certificates issued by the Indian certificate authority eMudhra have leaked, according to tech42.co.kr. The keys are cryptographically weak, which would allow attackers to forge trusted TLS certificates for arbitrary websites.
Google's Chrome Root Program team, Mozilla, Apple, Cloudflare and the Go Project responded by blocking the compromised certificates and releasing defensive patches.
System administrators and users are being urged to update to the latest versions of the affected software.
Why the leak matters
Intermediate certificates sit within the chain of trust that browsers and operating systems rely on to verify secure connections. Weak keys in that chain can let an attacker produce certificates that appear legitimate for any site.
The blocking action means the compromised certificates should no longer be trusted on updated systems. Devices and servers that are not patched may continue to accept them.
Quick answers
Which certificates were affected by the eMudhra leak?
Private keys for eight intermediate certificates issued by the Indian certificate authority eMudhra leaked.
What should users do about the eMudhra certificate leak?
System administrators and users are urged to update to the latest versions following the defensive patches released by Google's Chrome Root Program team, Mozilla, Apple, Cloudflare and the Go Project.