BlockBeats report: On October 21, a certificate authority (CA) security incident that drew widespread attention from the global cybersecurity community was exposed. Security researchers discovered that eMudhra, a CA based in India, had issued eight intermediate certificates with severely flawed private key generation. Due to implementation errors, these private keys—intended to have extremely high security strength—contained actual usable information equivalent to very small integers (such as 4, 56, 66, etc.), allowing security personnel to fully crack them in less than a second. This vulnerability has rendered the foundational trust mechanism for securing online communications effectively useless.
Intermediate certificates are a critical link in the HTTPS encryption trust chain; if their private keys are easily compromised, attackers can use them to forge trusted HTTPS certificates and launch man-in-the-middle attacks against banks, email services, or any trusted website, intercepting, altering, or stealing users' communication data. The root cause of the incident was not a malicious external intrusion, but a catastrophic implementation error by eMudhra during certificate generation, resulting in private keys with near-zero security.
After the incident was disclosed, major global browsers and software vendors swiftly implemented emergency defensive measures. Chrome, Firefox, Apple, and Microsoft have all released security updates to blacklist these eight compromised intermediate certificates, preventing users from accessing fake certificates issued by them. Meanwhile, eMudhra has officially revoked these flawed certificates. Additionally, due to widespread reliance on embedded certificate trust stores, leading development languages and frameworks—including Go, Python, Rust, and Electron—have urgently rolled out updates to block the affected certificates within their respective ecosystems.
To date, global security agencies have found no evidence that these vulnerable private keys have been maliciously exploited to issue fraudulent certificates. However, given the vast number of IoT devices and outdated systems that have not been updated, fully addressing this security risk will take time. Security experts advise users that the most immediate and effective protection is to ensure their browsers and operating systems are up to date, so they can receive the latest certificate blacklists and safeguard their online security.