Indian CA eMudhra exposed private key generation vulnerability, global browsers urgently blacklist to prevent man-in-the-middle attacks.

October 21 - A certificate authority (CA) security incident that has drawn intense attention from the global cybersecurity community has been exposed. Indian CA eMudhra was found by security researchers to have extremely severe generation flaws in the private keys of 8 intermediate certificates it issued. These private keys, which should have had extremely high security strength, due to implementation errors, actually contained effective information equivalent to extremely small integers (such as 4, 56, 66, etc.), allowing security personnel to completely crack them in less than a second. This vulnerability renders the trust foundation originally used to secure network communications virtually useless.

Intermediate certificates are a critical link in the HTTPS encrypted trust chain. Once their private keys are easily obtained, attackers can use them to forge trusted HTTPS certificates and then launch man-in-the-middle attacks against banks, email services, or any trusted website, intercepting, tampering with, or stealing users' communication data. The root cause of the incident was not malicious intrusion by external hackers, but a catastrophic implementation error by eMudhra in the certificate generation process, producing private keys with nearly zero security.

After the incident was exposed, major global browser and software vendors quickly took emergency defensive measures. Chrome, Firefox, Apple, and Microsoft have all released security updates adding these 8 risky intermediate certificates to blacklists, preventing users from accessing fake certificates issued by them. At the same time, eMudhra itself has officially revoked these flawed certificates. In addition, because a large amount of software relies on built-in certificate trust stores, mainstream development languages and frameworks such as Go, Python, Rust, and Electron have also urgently pushed updates to ban these affected certificates within their respective ecosystems.

As of now, global security agencies have not found evidence that these vulnerable private keys have been maliciously exploited to issue forged certificates. However, considering the huge number of IoT devices and legacy systems that have not been updated in time, fully cleaning up this security risk will still take time. Security experts remind users that the most direct and effective protection measure at present is to ensure that browsers and operating systems are kept up to date, so as to promptly obtain the latest certificate blacklists and safeguard their own network access security.