🔒eMudhra's Private Keys Compromised, Forgeable Certificates Issued
Your digital certificates might be fake
TL;DR
eMudhra's private keys were compromised, leading to the issuance of forgeable digital certificates. This could allow attackers to impersonate websites or resources. The company is working on replacements, but it's a long and costly process.
eMudhra's private keys were compromised, leading to the issuance of forgeable digital certificates. These certificates can be used to forge digital identities and impersonate websites or resources. This is a serious security risk for anyone using eMudhra's certificates. The compromised keys include the number '4' and other easily guessed two-or-three-digit numbers. The company is working to establish the root cause of the flaw and provide replacement certificates, but the process will be lengthy and costly. The incident will not significantly impact eMudhra's bottom line, but it poses a significant reputational risk.
Key Points
eMudhra's private keys were compromised during a Key Generation Ceremony on April 30, 2025.
The compromised keys include the number '4' and other easily guessed two-or-three-digit numbers.
The weak keys were published to the browser root stores, allowing for the forging of digital certificates.
eMudhra is working to establish the root cause of the flaw and provide replacement certificates.
The incident will not significantly impact eMudhra's bottom line, but it poses a significant reputational risk.
Why It Matters
If you're using eMudhra's digital certificates, your security is at risk. The compromised keys can be used to forge digital identities and impersonate websites or resources. The company is working to replace the compromised certificates, but this will be a long and costly process for affected users. Anyone relying on eMudhra's certificates needs to be vigilant and monitor for any signs of compromise.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.