Browser makers block eight compromised eMudhra certificate authority keys
Weak private keys affected eight intermediate certificates, creating a risk that clients could trust forged certificates. BleepingComputer reports that researchers could recover the keys almost instantly and that eMudhra revoked the certificates. Google, Mozilla, Apple and the Go project have moved to block the affected certificates.
- Cloudflare is deploying mitigations and releasing client updates.
- The Hacker News reports that Go 1.27.3 and 1.26.10 reject certificate chains using the affected keys.
Covered by 5 publishers within 13 hours of the first report: 4 news reports and 1 from the company.
- The Hacker News: Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
- Latest BleepingComputer: Mozilla, Google, Apple block compromised eMudhra CA certificates
Reporting4
The Hacker News Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns · info@thehackernews.com (The Hacker News)
Cyber Security News eMudhra Certificate Authority Compromise Triggers Emergency Action Across Browsers · Guru Baran
Dark Reading Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys · Jai Vijayan
BleepingComputer Mozilla, Google, Apple block compromised eMudhra CA certificates · Lawrence Abrams
From the company1
Cloudflare 8 eMudhra certificates are compromised. Here's what you need to know · Christopher Patton