EMudhra Intermediate CA Compromise
Eight intermediate CA certificates from eMudhra have been compromised, allowing potential impersonation of secure websites. Major browser vendors have already revoked trust in these certificates to protect users.
Why it matters
This is a critical security failure in the web's trust infrastructure that requires immediate browser and OS updates to mitigate.
The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.
To demonstrate that the keys are compromised, the original reporter Wayne signed the following message with the private key of each of the eight intermediate CAs and reported it to the Root Program Teams on the 17th of October:
proof.zip contains the message, and for each intermediate the certificate, its public key and a signature on the message. To verify with OpenSSL:
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in