Tech giants have taken swift action to block eight vulnerable digital certificates issued by India-based certificate authority eMudhra Limited. The certificates, found to have insufficiently secure private keys, could allow attackers to impersonate legitimate websites. Mozilla cryptography engineer Dennis Jackson confirmed in an incident report that the key-generation process was flawed and easily exploitable.
By Tuesday, major technology companies had deployed protections against the affected certificates. Mozilla Firefox’s security team blocked the certificates using OneCRL and released updates for its browser on Desktop and Android. Cloudflare also updated its Cloudflare One and WARP Clients, along with mitigations across its services. The certificates were blocked in Chrome since Saturday, on Apple devices since Monday, and on Microsoft platforms since Tuesday.
While there is no evidence of attacks on Firefox, Chrome, Edge, or Safari, the threat remains for applications and systems that do not receive automatic updates. Jackson noted that many clients outside the browser ecosystem do not enforce Certificate Transparency, leaving them potentially vulnerable.
The incident echoes the 2011 breach of DigiNotar, where hackers compromised the Dutch certificate authority and issued fraudulent SSL certificates. The rogue certificates allowed threat actors to pose as Google and spy on Iranian Gmail accounts.