🔒eMudra Issues 8 Weak TLS Certs with Flawed Keys
Your browser's trust in eMudra just took a hit
TL;DR
eMudra, a certificate authority, issued eight TLS credentials with dangerously weak encryption keys. The flaw was discovered and certificates blocked within days, but the impact on trust is significant.
eMudra issued eight TLS credentials with encryption keys as weak as 3 to 8 bits, instead of the expected 384 bits. This happened during a Key Generation Ceremony on April 30, 2025, due to a flaw in the KGC process. The weak keys were published to browser root stores, affecting trust in eMudra's certificates. The company is now reviewing every key ceremony to prevent future issues. This incident highlights the critical importance of rigorous security practices in certificate authorities.
Key Points
eMudra issued eight TLS credentials with encryption keys as weak as 3 to 8 bits, instead of the expected 384 bits.
The flawed keys were created during a Key Generation Ceremony on April 30, 2025.
The certificates were published to browser root stores, affecting trust in eMudra's credentials.
The company is now reviewing every key ceremony to prevent future issues.
The CA/Browser Forum may revoke eMudra's certificate authority status due to the security breach.
Why It Matters
If you rely on eMudra for TLS certificates, your trust in the security of your website or application is now compromised. The weak keys could be exploited, leading to potential security breaches. The incident underscores the need for stringent security practices in certificate authorities.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.