Eight intermediate certificate‑authority (CA) keys belonging to eMudhra were found to have been compromised, a revelation confirmed by Mozilla and Google’s Chrome Root Program on October 20. The breach means that anyone who has obtained one of these private keys could issue forged certificates for any website that browsers would normally trust.
Intermediate CAs are the linchpins of the public‑key infrastructure that underpins secure web traffic. They sign the certificates that websites present to browsers, and a compromised key therefore allows an attacker to create a certificate that browsers will accept as authentic.
According to the report, a security researcher first flagged the vulnerability, prompting the two major browser vendors to investigate and issue emergency fixes. The updates are designed to revoke the affected certificates and prevent the compromised keys from being used to issue new, fraudulent certificates.
Both Mozilla and Google have urged users to keep their browsers and operating systems up to date to ensure that the new security patches are applied. The incident underscores the importance of robust key management and vigilant monitoring of CA infrastructure.
While the full scope of the compromise is still being assessed, the rapid response by the browser vendors is expected to mitigate the risk of widespread misuse of the eMudhra certificates.
<small>Source: The Hacker News — read the original story there.</small>
