eMudhra Weak Link Tests India’s Chain Of Digital Trust

A flaw in Bengaluru-based eMudhra’s key-generation process left eight intermediate certificate authorities with weak private keys, and creating a panic of sorts in the global cybersecurity ecosystem

The immediate concern is whether software still trusting the compromised keys could accept fraudulent certificates despite Google, Mozilla, Apple, and Microsoft blocking the affected certificates

While no end-entity certificates were found in public logs, outdated software, servers and devices that continue to trust affected certificates may face residual risk.

Added to Saved Stories in Login VIEW SAVED STORIES .inc42-toggle-item-popup { display: none; position: relative; } .toggle-item-close { text-align: end; padding: 8px 12px 0px 10px; position: absolute; right: 0; cursor: pointer; } .toggle-items-content-main { display: block; position: relative; top: 27px; left: -204px; border-radius: 12px; background: #FFF; box-shadow: 0px 4px 24px 0px rgba(100, 100, 100, 0.25); width: 435px; height: 115px; } .toggle-items-content { display: flex; align-items: baseline; justify-content: center; padding-top: 22px; } .toggle-items-content .items-content-text .h4-saved-story{ color: #000; font-size: 20px; font-style: normal; font-weight: 700; line-height: normal; text-transform: capitalize; margin: 2px 0 10px 6px; } .toggle-items-content .items-content-text .myInc42-plus-dark { width: 100px !important; } .toggle-items-content .items-content-text .myInc42-light { width: 80px !important; } .toggle-items-content .items-content-text img{ height: 22px; } .view-my-feed-btn { width: 100%; text-align: center; display: flex; justify-content: center; } .view-my-feed-btn a { width: auto !important; } .view-my-feed-btn button { border-radius: 4px; background: linear-gradient(180deg, #DA1B4D 0%, #E23026 100%); color: #fff; font-size: 12px; display: inline-block !important; min-width: 162px; width: 162px !important; height: 34px !important; font-style: normal; font-weight: 700; line-height: normal; padding: 10px; cursor: pointer; } .CustomIconStyled { position: absolute; right: 180px; top: -80px; } .SubDropdownModelShare .sub-arrow-icon { width: 76px; height: 80px; position: relative; overflow: hidden; box-shadow: none; } @media (max-width:767px) { .toggle-items-content .items-content-text .h4-saved-story{ margin: 4px 0 10px 6px; font-size: 18px; } .toggle-items-content { align-items: center; } }

A private key meant to vouch for the security of websites around the world turned out to be the number 4.

That was one of the weaknesses researchers found in eight intermediate certificate authority (CA) certificates issued by Bengaluru-based eMudhra. 

The discovery prompted Google, Mozilla, Apple, and Microsoft to block the affected certificates, triggering a wider effort to protect browsers, applications, and enterprise systems. The incident also rattled investors........

© Inc42