Mozilla, Google and Apple Block Compromised eMudhra Certificates

Certificate authority eMudhra has revoked eight compromised intermediate certificates after researchers determined that their private keys were weak enough to be recovered almost immediately, according to BleepingComputer. With those keys exposed, an attacker could forge trusted certificates for legitimate websites.

The root of the problem was a flaw in how the private keys were generated. Cointelegraph reported that the weakness allowed anyone to guess the keys and produce fraudulent HTTPS certificates for any website, which could be used to impersonate genuine sites.

eMudhra is an Indian company that issues certificates vouching for the identity of websites, CoinDesk reported. The outlet noted that the compromise represents a generic security risk rather than one specific to cryptocurrency.