GoKawiileMudhra TLS certificate authority found issuing certs with crackable private keys
Security researchers discovered eight intermediate TLS certificates issued by India-based certificate authority eMudhra Limited that used private keys weak enough to be cracked, allowing anyone to forge trusted credentials for any website. An anonymous advisory, signed using one of the compromised keys to prove authenticity, alerted the security community over the weekend. Browser makers and major software platforms moved quickly to block the eight certificates, though no malicious use has been detected in certificate transparency logs so far.
GoKawiil's interpretation of the reporting above, not reported fact.
Cryptography engineer Filippo Valsorda compared the scale of the cleanup to the Heartbleed bug, warning it could take a long time to purge the weak keys from IoT devices, Docker containers, old Linux machines and bundled software roots. Because so many devices and systems embed their own copies of trusted certificate roots, remediation may lag well behind the initial blocking by major browsers, leaving a window of risk for less-maintained infrastructure.
- Eight eMudhra intermediate certificates had weak private keys exploitable to forge trusted TLS credentials for any site.
- Major browsers and software platforms have already blocked the compromised certificates, with no confirmed malicious use detected yet.
- Experts warn the broader cleanup across IoT devices, Linux distributions and legacy software could take much longer and rival the Heartbleed incident in scope.
Source: arstechnica.com, 2026-10-20
Published there as: “The Internet goes on high alert after discovery of 8 compromised TLS certs”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.