eMudhra Revokes 8 Intermediate CA Certificates Due to Weak Keys; Chrome and Other Browsers Have Removed Associated Trust Root Certificates
A Mozilla investigation revealed that eight intermediate CA certificates from eMudhra had private keys with only 8 bits of entropy, enabling recovery via brute-force attacks on values 0–255. Six keys could issue TLS certificates; two were used for code signing. On October 17, Mozilla blocked them via Firefox OneCRL. On the same day, Google blocked the affected public keys through Chrome CRLSet and planned to remove associated trust anchors on October 27.
8 Intermediate CA Certificates from eMudhra Revoked Due to Weak Keys; Chrome and Other Browsers Have Removed Associated Trust Roots
A Mozilla investigation found that the private keys of 8 intermediate CA certificates from eMudhra had only 8 bits of entropy, allowing them to be recovered by brute-forcing values between 0 and 255. Of these, 6 could issue TLS certificates, while the other 2 were used for code signing.
On October 17, Mozilla issued a block via Firefox OneCRL. On the same day, Google blocked the affected public keys through Chrome CRLSet and planned to remove the associated trust roots on October 27, which could impact some legitimate certificates. Apple, Microsoft, and others have also taken action.
Sources: Mozilla Security | Google | Bug 2083449