Browser developers and other technology companies deployed blocks against eight intermediate certificates issued by India-based eMudhra Limited after their private keys were found to be insufficiently secure. Mozilla said it independently recovered the keys and called the key-generation process “trivial to exploit.” An attacker who intercepts a connection could use a fraudulent certificate to impersonate a website and potentially read or alter exchanged information.
Mozilla said it blocked the certificates in Firefox and released a Desktop and Android update for users whose settings prevented them from receiving the block automatically. Cloudflare reported updates to its clients and services, and Mozilla engineer Dennis Jackson said Chrome, Apple devices and Microsoft platforms had also blocked the certificates. Systems that do not receive the blocks automatically remain at risk. Jackson said there was no evidence of attacks on major browsers, but it was unknown whether attackers had targeted clients outside browsers that do not enforce Certificate Transparency.
