Security alert issued following compromise of eight eMudhra TLS certificates
Browser vendors and developers have blacklisted eight intermediate TLS certificates issued by India-based eMudhra after private keys were found to be cryptographically insecure.
Security teams worldwide are addressing a vulnerability involving eight intermediate TLS certificates issued by Indian certification authority eMudhra Limited. The certificates were identified with weak private keys, theoretically allowing unauthorized parties to generate trusted credentials for websites and applications.
Browser manufacturers and major software developers have blocked the affected certificates to mitigate potential exploitation. While certificate transparency logs have not yet identified any malicious use of the keys, security professionals warn that the risk persists for systems that are difficult to update, including Linux distributions and various Internet of Things (IoT) hardware.
The vulnerability was publicly highlighted when a third party signed a message using one of the compromised private keys, confirming their ability to bypass standard authentication protocols. While the immediate threat to web browsers is mitigated by widespread blacklisting, the incident underscores the ongoing challenge of securing legacy and embedded network infrastructure.