Consensys Warns Ethereum Operators of eMudhra Certificate Risk

Consensys has issued security guidance for Besu, Teku and Web3Signer operators after security flaws in eMudhra certificates raised the risk of forged certificates in some Ethereum deployments.

The teams behind the two Ethereum clients and the remote signing service have published separate steps for checking exposure and reducing risk. The impact depends on each installation’s configuration. Default configurations are unaffected, but some Web3Signer deployments need changes to access controls.

An attacker could impersonate a service with a forged certificate if a node or signing system still trusts the affected certificate authority through a Java trust store. Certificate authorities help software verify that a service is genuine; flaws in affected certificates undermine that check in affected systems.

There is no evidence that Ethereum validator private keys were exposed or that the network was attacked. The guidance addresses software used by Ethereum operators. Operators can use the published checks to review their trust stores and Web3Signer access controls.