Story thread

eMudhra TLS scandal

eMudhra is exiting the SSL/TLS certificate business after revelations that its certificate private keys were absurdly weak and compromised.

16 stories from 10 sources · since Oct 20

Clio’s read on this thread

Eight eMudhra intermediate TLS certificates were found compromised, with private keys so weak they could be recovered trivially. Major browser vendors and platform projects blocked or revoked trust, but the risk still reaches Linux, embedded, VPN, and other non-browser systems that update trust stores slowly. CIOs should inventory certificate dependencies, patch clients and proxies, and rotate affected certificates because trust-chain failures can break services and enable interception.

Key points

  • Eight eMudhra intermediate TLS certificates/private keys were compromised; some were described as only 3 to 8 bits strong.
  • Google, Mozilla, Apple, the Go project, and Cloudflare moved to block or revoke affected trust.
  • The impact extends beyond browsers to VPNs, email, Java, containers, IoT, Linux bundles, and custom trust stores.
  • eMudhra said it will exit the SSL/TLS certificate business; Reuters-linked coverage said the line is about 1% of revenue.
  • Cloudflare later reported attempts to use the weak keys and some forged certificates issued almost immediately after disclosure.

Where coverage agrees

  • Eight eMudhra intermediate TLS certificates or keys were compromised.Ars Technica · TechMeme · Dark Reading · Cloudflare Blog · The Register · Simon Willison's Weblog · Hacker News · CSO Online · Schneier on Security
  • Major browser vendors and platform projects blocked or revoked trust for the affected intermediates.TechMeme · Dark Reading · CSO Online · Cloudflare Blog
  • The incident creates risk beyond browsers, especially for enterprise, embedded, VPN, and other non-browser TLS clients.Ars Technica · The Register · Simon Willison's Weblog · CSO Online · Schneier on Security · Cloudflare Blog
  • eMudhra is leaving the global SSL/TLS certificate business after the compromise.TechMeme · The Register · Ars Technica · CSO Online
  1. 4 real? Tracking exploitation and patching of eMudhra’s weak keysCloudflare Blog · Oct 30 · Clio 84
  2. The Pulse: Time to rethink software security because of AI?The Pragmatic Engineer · Oct 30 · Clio 76
  3. Compromised TLS CertificatesSchneier on Security · Oct 23 · Clio 80
  4. eMudhra quits global TLS certificate market after compromise of CA signing keysCSO Online · Oct 23 · Clio 80
  5. Disgraced eMudhra drops out of TLS business after using cert private key of 4Ars Technica · Oct 22 · Clio 80
  6. Disgraced Indian cert issuer leaves the cert issuing businessThe Register · Oct 22 · Clio 74
  7. eMudhra says it will exit the SSL/TLS certificate business, 1% of its revenue, after its TLS certificates with private keys of just 3 to 8 bits were compromised (Abhirami G/Reuters)TechMeme · Oct 22 · Clio 69
  8. Certification authority eMudhra defends its laughably weak private keysThe Register · Oct 22 · Clio 78
  9. Google, Mozilla revoke eMudhra intermediates after private key compromiseCSO Online · Oct 21 · Clio 87
  10. Eight Bits of Trust; eMudhra's CA keys cracked in millisecondsHacker News · Oct 21 · Clio 89
  11. eMudhra Intermediate CA CompromiseSimon Willison's Weblog · Oct 20 · Clio 85
  12. Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’The Register · Oct 20 · Clio 81
  13. 8 eMudhra certificates are compromised. Here's what you need to knowCloudflare Blog · Oct 20 · Clio 87
  14. Tech Giants Block eMudhra Certificates Tied to 8 Compromised KeysDark Reading · Oct 20 · Clio 71
  15. Eight intermediate TLS certificates from eMudhra with private key sizes of just 3 to 8 bits were compromised; browser makers and major apps have blocked them (Dan Goodin/Ars Technica)TechMeme · Oct 20 · Clio 79
  16. The Internet goes on high alert after discovery of 8 compromised TLS certsArs Technica · Oct 20 · Clio 79