Certification authority eMudhra defends its laughably weak private keys

eMudhra has responded to public disclosure that some of its issued digital certificates contained dangerously weak private keys—one literally the number 4, and others short digit strings. The company attributed the failure to a flaw in its Key Generation Ceremony that used FIPS 140-2 Level 3 Hardware Security Modules, suggesting weak keys were published to browser root stores instead of the intended strong keys. The incident poses a significant risk as malicious actors could forge certificates to impersonate websites or resources. eMudhra says it is investigating the root cause and working on replacements, a lengthy process across the infosec industry.

Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The Register did the reporting; read the original for the full story.