WORLDTECHApple Blocks eMudhra Web Certificates in Safari and Mail Over Weak Keys
Apple has been blocking web certificates issued under the Indian company eMudhra since October 19, after a security researcher found that the private keys behind eight of its intermediate certificate authority certificates were weak. Apple says most device owners need take no action.
What the researcher uncovered
Earlier this month, a security researcher found that the private cryptographic keys tied to eight of eMudhra's intermediate certificate authority certificates were weak. Those keys are the secret components that verification of encrypted connections depends on.
So far, there is no evidence that anyone has used the weakness for malicious purposes.
Apple's block in Safari and Mail
In a support document, Apple says it has been blocking eMudhra's compromised TLS certificates since October 19. TLS is the encryption that protects a connection to a website. The block applies in Safari, in Mail and in apps that rely on Apple's networking and security frameworks.
The blocking happens automatically and requires no software update, so most owners of Apple devices have nothing to install or change.
Why the compromised keys matter
The compromised keys could have let attackers pass themselves off as legitimate websites, potentially endangering users' sensitive information. eMudhra's certificates had been trusted by all major web browsers, including Safari, Chrome, Edge and Firefox, and the companies behind those browsers have since acted to protect their users.
Open questions
- Will the other browser makers publish their own blocks for eMudhra's certificates?
- Has any site or user been affected by the weak keys?