Tech giants rush to block 8 eMudhra certs that could enable fake sites

A private key generation flaw allowed anyone to guess them and forge HTTPS certificates for any website.

Tech giants have deployed emergency blocks against eight vulnerable digital certificates that could allow attackers to impersonate legitimate websites.

By Tuesday, browser developers and other major technology companies had deployed protections against eight intermediate certificates issued by India-based certificate authority eMudhra Limited after discovering that their private keys were insufficiently secure. 

Mozilla cryptography engineer Dennis Jackson wrote in an incident report that Mozilla independently recovered the private keys when it first received notice of the flaw on Saturday, confirming that the key-generation process was “flawed” and “trivial to exploit.” 

Read more