GoogleAnalysisCompromised eMudhra intermediate CA keys trigger emergency browser and runtime blocks
What happened.Browser vendors and runtime maintainers released urgent security updates to distrust eight intermediate certificate authority keys operated by eMudhra after private keys with near-zero entropy were exposed.
Why it matters.Compromised intermediate certificate authorities undermine the fundamental trust model protecting encrypted web communications. Developers and infrastructure operators must update container base images and runtime certificate stores today to ensure API gateways reject fraudulent certificates signed by the revoked intermediate keys.
The technical specifications:
- Cryptographic flaw: Flawed key generation algorithms produced private keys with single-byte entropy values, allowing attackers to calculate private key material without factoring standard moduli.
- Impersonation hazard: Compromised intermediate certificates could sign fraudulent TLS certificates for arbitrary web domains, enabling active traffic interception and spoofing attacks.
- Ecosystem containment: Google Chrome and Mozilla deployed immediate certificate revocation lists while the Go team published releases 1.27.3 and 1.26.10 to block the affected certificate chains.