eMudhra weak CA keys let anyone forge certificates; update your clients
Original title：4 real? Tracking exploitation and patching of eMudhra’s weak keys
What happened
eMudhra's eight intermediate CA keys are so weak that anyone can recover them from public certificates and forge certificates trusted by unpatched clients. Cloudflare saw forged certificates within hours of disclosure but no evidence of interception; over half of probes on large networks still trust the bad chain.
Who is affected
- Anyone managing Macs or office devices
- Operators of bots or client software
- Cloudflare WARP or Tunnel users
What to do
Update OS, browsers and dev environments (especially macOS developers) and follow Dennis Jackson's crowdsourced instructions. Cloudflare WARP/Tunnel users should apply the steps in Cloudflare's earlier post.
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| eMudhra 発行の中間証明書を信頼するブラウザ・OS・クライアント | 要確認 | 要確認 |
| Android WebView | 要確認(30〜40%が受け入れ継続) | 要確認 |
Why this flag
影響は深刻で偽造証明書の作成も確認されたが、実際の通信傍受は確認されておらず、悪用の確定とは言い切れないため。
Double yellow: great danger, be ready to stop — Severe impact with a public exploit or reported (unconfirmed) exploitation, including RED candidates under review.
Sources
- Source：Cloudflare Blog ↗