All articles tagged with #emudhra
Eight intermediate TLS certificates from Indian CA eMudhra were found to have critically weak private keys, allowing anyone to mint trusted credentials for any website. Browsers and software vendors have blocked these certificates, but widespread updates remain pending.
Eight intermediate certificate private keys from Indian CA eMudhra were compromised, prompting emergency blocks by Chrome, Firefox, and Go. A researcher named Wayne reported the issue on October 17, leading to rapid revocation across major trust stores. No evidence of malicious use in Certificate Transparency logs has been found, but the incident highlights critical gaps in non-browser software updates.
Go released versions 1.27.3 and 1.26.10 on October 20, 2026, to block eight intermediate certificate keys from Indian authority eMudhra. The update rejects any certificate chain passing through these keys, citing 'specific security concerns.' Mozilla had already blocked six related certificates on October 17. The incident involves keys with abnormally low entropy, ranging from 3 to 8 bits, which could allow unauthorized issuance of trusted credentials. No public explanation for the breach has been provided by eMudhra or Go.