Summary / Read source ↗
- A certificate authority (CA) is a top-level organization that browsers and devices trust by default. It is the starting point for checking whether a website's HTTPS certificate is genuine, so if this organization's private key is exposed, fake certificates that look normal can be created.
- According to the source, eMudhra created a very weak intermediate CA key because of a bug in its key generation script, and this key was wrongly adopted for actual operation. The source says the top 47 bytes were 0, making it effectively a key at the level of 1 bytes. This point cites analyst Scott Helme's post.
- The author interprets that with a key this weak, an attacker could recover the signing key and create forged certificates, which could be used in man-in-the-middle attacks such as on public Wi-Fi. The source does not confirm any actual case of exploitation.
- eMudhra said it revoked the related CA within 14 hours of discovery, that no final certificates were issued, and that no data was leaked. It later announced it would exit the global TLS certificate business, and the author criticizes this response for lacking an acknowledgment of responsibility.