Weak Keys in Eight eMudhra Certificates Could Enable Website Spoofing

Eight certificates issued by eMudhra have private keys so weak that attackers could forge certificates for almost any website on systems that still trust them, despite blocks by major browsers.

The certificates are part of the system software uses to verify a website’s identity. A forged certificate could make an impostor appear to be the intended site to an affected system. Because the weak keys belong to a certificate authority, the potential risk extends beyond any one website.

Major browsers have blocked the eight affected certificates. Servers, Linux systems and connected devices may still need updates to stop accepting them. Browser protections alone do not cover software that uses a separate or outdated list of trusted certificates.

eMudhra is an Indian certificate issuer, but the trust system involved is used across the internet. The remaining work is to update systems outside the major browsers so they reject certificates tied to the weak keys.