Tech Giants Block Eight Flawed eMudhra Certificates That Could Enable Fake Websites

Browser makers and major technology firms have blocked eight intermediate certificates issued by India-based certificate authority eMudhra after finding their private keys were not secure enough. A flaw in the key generation process meant anyone could guess the keys and forge HTTPS certificates for any website. Mozilla cryptography engineer Dennis Jackson said Mozilla recovered the keys on its own after receiving notice on Saturday, and described the process as flawed and trivial to exploit.

How Browsers and Cloudflare Responded

Firefox blocked the certificates through OneCRL the same day it got the report, then shipped updates for Desktop and Android to cover users with custom settings that prevented the OneCRL update. Cloudflare learned of the issue on Monday and released updates for Cloudflare One, WARP Clients and Cloudflare Tunnel on Tuesday, along with wider mitigations. According to Jackson, Chrome has blocked the certificates since Saturday, Apple devices since Monday and Microsoft platforms since Tuesday. The flaw was responsibly disclosed to trust stores on October 19.

Echoes of the 2011 DigiNotar Breach

The case recalls the 2011 DigiNotar attack, in which hackers compromised the Dutch certificate authority and issued 531 fraudulent certificates. Those certificates let attackers pose as Google and spy on roughly 300,000 Iranian Gmail accounts.