Mozilla received a report on 17 October that the private keys of eight intermediate certificates from Indian certificate authority eMudhra had been compromised, because they were weak enough to be recovered almost instantly. Anyone holding them could issue fake HTTPS certificates for websites they do not control. Firefox blocked the certificates through OneCRL in under three hours, and new releases plus an NSS update removing the root followed. Google and other vendors also took action.

What it means: HTTPS rests on trust in hundreds of certificate authorities, and a weakness in just one of them is enough to threaten everyone. The problem here was not a break-in but poor key generation, which made the keys easy to reproduce. Browsers reacted quickly, and users with an up-to-date Firefox or Chrome are already protected. The risk remains for applications and devices that use their own trust stores without checking revocation, such as older Linux systems, embedded devices or internal business tools. Administrators should update certificate bundles and, where possible, remove the affected eMudhra root. Businesses that buy certificates through resellers should also check which authority actually stands behind them. The incident strengthens the case for shorter certificate lifetimes and automated renewal, so a problem can be fixed without manual work. Finally, it shows why public Certificate Transparency logs matter: they let researchers spot such weaknesses before attackers exploit them.

Read the original on Mozilla Security Blog

Related service: Custom software

Related stories