Weak TLS keys expose internet to forged certificates, prompting global security alert

Researchers discovered that eight intermediate TLS certificates issued by the Indian certificate authority eMudhra Limited contain private keys so weak they could be used to forge trusted browser and app credentials for any website. An advisory posted on a domain linked to eMudhra, signed with one of the compromised keys, proved the attackers’ control. In response, browser makers and several major applications have blocked all eight certificates, though no malicious use has yet appeared in certificate-transparency logs.

The remediation effort is expected to be extensive, as many platforms—including Linux distributions, embedded systems, IoT devices, Docker containers and language-specific root stores—embed their own copies of trusted roots. Cryptography engineer Filippo Valsorda likened the task to a cleanup larger than the Heartbleed incident, noting the long tail of outdated or unmaintained systems that will need patches.