As cited
Copy frozen at (site build).
breaches incidents
Certification authority eMudhra defends its laughably weak private keys
Indian certification authority eMudhra issued digital certificates signed with critically weak private keys, including one composed of just the number 4 and others consisting of simple two- or three-digit numbers that are trivial to deduce. The company attributes the failure to a flaw in its key generation ceremony on April 30, 2025, which occurred despite using compliant hardware security modules, and is now working to replace affected certificates. eMudhra's statement deflects some responsibility to auditors and other stakeholders while noting the incident affects only 1 percent of its revenue.
Why it matters: Organizations and end users relying on eMudhra-issued TLS certificates must urgently identify and replace them to prevent attackers from forging certificates and impersonating their services or resources.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
breaches incidents
Certification authority eMudhra defends its laughably weak private keys
Indian certification authority eMudhra issued digital certificates signed with critically weak private keys, including one composed of just the number 4 and others consisting of simple two- or three-digit numbers that are trivial to deduce. The company attributes the failure to a flaw in its key generation ceremony on April 30, 2025, which occurred despite using compliant hardware security modules, and is now working to replace affected certificates. eMudhra's statement deflects some responsibility to auditors and other stakeholders while noting the incident affects only 1 percent of its revenue.
Why it matters: Organizations and end users relying on eMudhra-issued TLS certificates must urgently identify and replace them to prevent attackers from forging certificates and impersonating their services or resources.
- Source published
- First seen by Cybersecurity Tracker