Weak Secret Keys at eMudhra Compromise Digital Certificates
Browser makers and software developers rush to issue patches after a security researcher reveals that eMudhra used weak secret keys.
Weak Secret Keys at eMudhra Compromise Digital Certificates
Browser makers and software developers rush to issue patches after a security researcher reveals that eMudhra used weak secret keys.
Digital Certificate Vulnerability Discovered
The internet infrastructure has faced an urgent scramble to patch a major security flaw involving digital certificate authority eMudhra. On October 17, a security researcher named Wayne alerted browser makers that eight secret keys utilized by the Indian company were critically compromised.
To demonstrate the vulnerability, the researcher successfully utilized all eight compromised keys to digitally sign a warning message reading "We have a problem here – Wayne." Certificate authorities like eMudhra issue digital certificates that browsers use to confirm whether a website is authentic, relying on private master stamps to sign these credentials.
Weak Keys and Emergency Patches
According to reports, the compromised keys were generated using tiny integers such as 4, 56, and 237 rather than secure, large 384-bit random numbers. Researcher Helme noted that these weak keys had been exposed since April 2025 and could be recovered from public certificates in under a second.
Mozilla received the report on October 17 and implemented a block within three hours. Chrome blocked the affected certificates on the same day, while Apple followed on October 19 and Microsoft on October 20. eMudhra has since revoked the compromised certificates, and Mozilla warned that network interceptors could have used them to impersonate trusted sites.
Impact on Software and Crypto Ecosystem
While browser vendors acted quickly, experts point out that many backend tools and programs do not check if a certificate has been revoked. Testing showed that tools including curl, Python, Node, Go, and Java accepted forged certificates for services like Stripe's API, though fixes have been released for several of these packages.
Mudit Gupta, chief technology officer at Polygon Labs, noted that the issue primarily affects users running older or unpatched software rather than being a crypto-specific vulnerability. Crypto tools, trading scripts, and wallet backends running on environments like Python, Node, or Go could theoretically face risks if operators fail to keep their software updated.
About The Author
