eMudhra
CompanyFacts
- Country
- IndiaSource: Wikidata
- Founded
- 2008Source: Wikidata
- Official website
- emudhra.comSource: Wikidata
Security timeline
- Security update reported by Debian Security AdvisoriesDebian updates nss package to remove compromised eMudhra certificates
- Vulnerability reported by Cloudflare Blog (Security)Cloudflare tracks exploitation and patching of eMudhra's weak intermediate CA keys
Recent news
Debian updates nss package to remove compromised eMudhra certificates
Debian Security Advisory DSA-6599-1 provides updated nss packages that remove three eMudhra root certificates: eMudhra emSign Root CA - G3, eMudhra emSign Root CA - C1 and emSign ECC Root CA - C3. The advisory states that several eMudhra intermediate CA certificates were compromised, and the update removes the affected trust anchors from the system store.
Cloudflare tracks exploitation and patching of eMudhra's weak intermediate CA keys
Cloudflare reports that eMudhra's eight intermediate private keys, one of which was simply the number 4, can be recovered from the public certificates, letting anyone forge certificates that unpatched clients not enforcing Certificate Transparency would accept. Cloudflare patched high-priority systems, including Pingora origin-facing proxies, within hours and logged about 22,000 handshakes using the weak keys, all refused where verification was enabled. About 160 handshakes carried forged certificates, one dated less than an hour after Mozilla's bug report went public, but they appeared to be servers' own default certificates rather than interception attempts.