Bengaluru security slip-up leaves browsers distrusting eMudhra Ltd. TLS certificates
A big web security slip-up just hit Bengaluru: eight private keys from eMudhra Ltd. got leaked, putting important government websites at risk.
Because of this, 6 of the impacted certificates are for TLS and trusted by the Chrome, Mozilla, Microsoft and Apple root programs quickly stopped trusting these certificates and pushed out urgent security fixes.
Weak keys found, eMudhra revokes certificates
An anonymous researcher first noticed the problem: the certificates used super-weak keys (think four as a password).
eMudhra has now revoked the affected certificates and started working with browser teams to fix things.
While only one certificate authority was actually active and no user-level certificates were handed out, experts warn that updating all impacted devices, especially IoT gadgets, could be tough.
The main root certificates are still safe, but this incident has sparked fresh doubts about how secure Indian certificate providers really are.