WORLDTECHeMudhra revokes eight weak intermediate certificates after key-recovery flaw
Certificate authority eMudhra has revoked eight compromised intermediate certificates after researchers found their private keys were weak enough for anyone to recover almost instantly. According to BleepingComputer, the flaw meant the keys could be used to forge trusted certificates for legitimate websites.
What the researchers found
Certificate authority eMudhra has revoked eight intermediate certificates it had issued. The move followed findings that the private keys behind them were so weakly protected that anyone could recover them in almost no time.
BleepingComputer, which reported the case, said the weakness allowed the keys to be turned into a tool for forging certificates that browsers would trust, including certificates for legitimate websites.
Who is affected
Apple, based in Cupertino and founded in 1976, and Google, based in Mountain View and founded in 1998, are both companies whose software relies on trusted certificates. The facts available here do not say how either company has responded to the revocation.
Open questions
- Which websites, if any, were impersonated with forged certificates?
- How have Mozilla, Google and Apple acted on the revocations so far?