SignalPost

← Stories

eMudhra Certificate Keys Compromised, Prompting Browser and Software Blocks

Eight intermediate TLS certificate authority keys from India's eMudhra were found to be compromised, with keys so weak they could be recovered easily, prompting Google, Mozilla, Apple, the Go project and others to block the affected certificates.

18newsrooms
28articles
7.2 daysrunning
Oct 20first seen

Ask Scout

Scout answers questions about this story using only the coverage below.

Coverage over time

Oct 20 4 AM: 12 articlesOct 21 4 AM: 4 articlesOct 22 4 AM: 8 articlesOct 25 4 AM: 2 articlesOct 27 4 AM: 2 articlesOct 20 4 AMOct 27 9 AMpeak 12 per day

Articles

Oct 27, 9:41 AM pcworld.com Microsoft pulls 7 eMudhra certificates from Windows. Here’s what that means
Oct 27, 5:30 AM theregister.com Microsoft releases out-of-band Windows fixes with certificate updates
Oct 25, 4:07 PM macrumors.com Apple Addresses Web Security Threat, Working on macOS Update With Additional Fix
Oct 25, 8:33 AM it.slashdot.org As eMudhra Exits Cert Business, Users Face New PKI Trust Decisions
Oct 22, 1:17 PM arstechnica.com Disgraced eMudhra drops out of TLS business after using cert private key of 4
Oct 22, 11:46 AM therecord.media Indian tech company eMudhra announces withdrawal from certificate business after security incident
Oct 22, 11:12 AM thehackernews.com eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable
Oct 22, 9:58 AM theregister.com Disgraced Indian cert issuer leaves the cert issuing business
Oct 22, 8:30 AM techmeme.com eMudhra says it will exit the SSL/TLS certificate business, 1% of its revenue, after its TLS certificates with private keys of just 3 to 8 bits were compromised (Abhirami G/Reuters)
Oct 22, 6:18 AM thenextweb.com eMudhra drops TLS certificates days after browsers blocked its keys
Oct 22, 5:30 AM tomshardware.com Leaked private keys for eight CA certificates let any attacker impersonate any domain
Oct 22, 4:43 AM macrumors.com Apple Blocks Certificates That Could Help Attackers Fake Websites
Oct 21, 11:38 PM theregister.com Certification authority eMudhra defends its laughably weak private keys
Oct 21, 6:44 AM appleinsider.com Apple blocks bafflingly weak security certificates on iPhone
Oct 21, 6:31 AM cointelegraph.com Big Tech’s eMudhra fixes may leave crypto bots exposed, CertiK warns
Oct 21, 5:16 AM 9to5mac.com Apple blocks web certificates that could be used by scammers, but Mac vulnerability remains
Oct 21, 4:22 AM securityweek.com Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys
Oct 21, 3:25 AM thenextweb.com Eight eMudhra certificate keys were so weak that one was the number 4
Oct 20, 10:15 PM cointelegraph.com Tech giants rush to block 8 eMudhra certs that could enable fake sites
Oct 20, 9:11 PM coindesk.com A company that vouches for websites had secret keys so weak that 8 of them were cracked
Oct 20, 5:46 PM bleepingcomputer.com Mozilla, Google, Apple block compromised eMudhra CA certificates
Oct 20, 4:50 PM simonwillison.net eMudhra Intermediate CA Compromise
Oct 20, 3:57 PM theregister.com Indian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’
Oct 20, 2:45 PM darkreading.com Tech Giants Block eMudhra Certificates Tied to 8 Compromised Keys
Oct 20, 2:30 PM techmeme.com Eight intermediate TLS certificates from eMudhra with private key sizes of just 3 to 8 bits were compromised; browser makers and major apps have blocked them (Dan Goodin/Ars Technica)
Oct 20, 12:47 PM arstechnica.com The Internet goes on high alert after discovery of 8 compromised TLS certs
Oct 20, 10:09 AM thehackernews.com Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software
Oct 20, 4:32 AM thehackernews.com Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns