Cloudflare tracks exploitation and patching of eMudhra's weak intermediate CA keys

eMudhra◼'s eight weak intermediate keys (values 4, 56, 66, 115, 155, 156, 230 and 237) are recoverable from public certificates, so any client that trusts them and does not enforce Certificate Transparency will accept forged certificates for any domain. Cloudflare◼ patched Pingora to reject them and added logging by October 21. It saw about 22,000 handshakes, two-thirds to test sites, with all verifying handshakes refused. About 160 presented certificates naming unrelated SANs, some valid for over two years; these looked like server default certificates and would have failed hostname verification. Defenders should remove or distrust the eMudhra intermediates, enforce Certificate Transparency, and watch for certificates chained to these keys. eMudhra says a key generation script mistake was responsible but has not shared the script.

For security analysts · Written by AI from 1 source · Wrong?