Weak eMudhra certificates blocked after key flaw found

Eight weak intermediate certificates issued by eMudhra, an Indian certificate authority, were blocked by major browser and technology providers after researchers found their private keys could be recovered and used to impersonate trusted websites. The certificates sit between a certificate authority’s root credentials and individual website certificates. If an attacker obtained control of an intermediate certificate, they could use it to issue fraudulent certificates for other domains, potentially allowing them to pose as legitimate sites and read or alter intercepted traffic. Mozilla engineer Dennis Jackson said Mozilla recovered the private keys associated with all eight certificates and judged the key-generation process flawed and trivial to exploit. The keys reportedly contained only a few bits of entropy, far below the hundreds of bits typically used to make private keys difficult to guess. A researcher identified as Wayne demonstrated control of an affected key by signing a warning message. Browser protections rolled out across platforms over several days. Mozilla said Chrome and Firefox began blocking the certificates on October 17, Apple devices on October 19, and...