All articles tagged with #tls security
Eight intermediate TLS certificates from Indian CA eMudhra were found to have critically weak private keys, allowing anyone to mint trusted credentials for any website. Browsers and software vendors have blocked these certificates, but widespread updates remain pending.
Go released versions 1.27.3 and 1.26.10 on October 20, 2026, to block eight intermediate certificate keys from Indian authority eMudhra. The update rejects any certificate chain passing through these keys, citing 'specific security concerns.' Mozilla had already blocked six related certificates on October 17. The incident involves keys with abnormally low entropy, ranging from 3 to 8 bits, which could allow unauthorized issuance of trusted credentials. No public explanation for the breach has been provided by eMudhra or Go.