Compromised security certificates blocked in Chrome, Firefox
Eight intermediate certificate authority private keys operated by Indian digital trust provider eMudhra were compromised, creating a significant security risk. The compromise was reported to Mozilla on October 17 and independently confirmed when Mozilla recovered the keys, determining that the key generation process was flawed and trivial to exploit. An attacker with these private keys could have impersonated any website or service. Both Mozilla and Google's Chrome Root program subsequently began blocking the affected certificates to mitigate the threat.
Key points
- 8 eMudhra intermediate CA private keys compromised on October 17
- Flaw allowed attackers to potentially impersonate websites or services
- Mozilla independently recovered and verified the vulnerable keys
- Chrome and Firefox blocked affected certificates to prevent misuse
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. Computerworld did the reporting; read the original for the full story.
Read the full story at Computerworld
