{"id":1195,"kind":"story","title":"Weak intermediate CA key at India's certificate authority eMudhra and its impact on HTTPS trust","url":"https://blog.jxck.io/entries/2026-10-25/emudhra.html","host":"blog.jxck.io","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-25T06:44:20.308Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["A certificate authority (CA) is a top-level organization that browsers and devices trust by default. It is the starting point for checking whether a website's HTTPS certificate is genuine, so if this organization's private key is exposed, fake certificates that look normal can be created.","According to the source, eMudhra created a very weak intermediate CA key because of a bug in its key generation script, and this key was wrongly adopted for actual operation. The source says the top 47 bytes were 0, making it effectively a key at the level of 1 bytes. This point cites analyst Scott Helme's post.","The author interprets that with a key this weak, an attacker could recover the signing key and create forged certificates, which could be used in man-in-the-middle attacks such as on public Wi-Fi. The source does not confirm any actual case of exploitation.","eMudhra said it revoked the related CA within 14 hours of discovery, that no final certificates were issued, and that no data was leaked. It later announced it would exit the global TLS certificate business, and the author criticizes this response for lacking an acknowledgment of responsibility."],"discussion":"https://startupxo.com/en/1195/","markdown":"https://startupxo.com/en/1195.md","api":"https://startupxo.com/api/v1/item.json?id=1195&lang=en","text":null,"edited":null,"sources":[{"site":"rss","name":"はてなブックマーク テクノロジー","url":"https://blog.jxck.io/entries/2026-10-25/emudhra.html","score":null,"comments":null,"observed_at":"2026-10-25T06:43:25Z"}],"thread":[{"id":466,"by":"startupxo","score":0,"time":"2026-10-25T06:44:20.308Z","text":"O: An engineer in charge of a web service could use this as a checklist to review which internal Electron apps and CLI tools store certificates in the OS certificate store.\nX: The original article relies on the author's interpretation and external analysis, so whether it has been exploited in practice is not confirmed. The article also does not say whether browsers block it or when each app's certificate store gets updated.","editorial":true,"replies":[]}]}