A major security flaw at the Indian tech company eMudhra could have allowed attackers to forge digital certificates, impersonate websites, and target billions of users. The company, which issues digital certificates to authenticate websites, disclosed that "weak" private cryptographic keys linked to eight of its "intermediate certificates" had been compromised.
These private keys, created on April 30, 2025, were accompanied by a second set of extremely weak keys due to a flaw in the generation process, alongside the original "strong" keys. According to an eMudhra press release, these keys, which should have the strength of a 116-digit number (384 bits), were in some cases as small as the digit "four."
The issue was discovered over the weekend by an independent researcher using the alias "Wayne." Through reverse-engineering, and possibly with the aid of AI-assisted techniques, he uncovered the weak keys and immediately alerted major owser companies like Apple, Google, Microsoft, and Mozilla.
To prove his claim, the researcher created a test site called "emudhra.we-have-a-problem.com" and on Tuesday posted a message digitally signed with one of the compromised keys. This action set off alarm bells worldwide.
Following the disclosure, owser companies, operating system vendors, and web infrastructure firms like Cloudflare scrambled to roll out updates and block the eight intermediate certificates in question. These certificates could have been used to impersonate any domain trusted by millions of servers globally.
Experts warn that while the swift action of tech companies prevented a potential catastrophe, the risk may not yet be entirely eliminated, and users should ensure their software is up to date.
Source: eMudhra Press Release
🌐
