PANews October 21 reported that Google and Mozilla October 20 separately stated that the Indian certificate authority (CA) eMudhra's 8 intermediate CA certificates had their private keys cracked due to flaws in the key-generation process and insufficient randomness. Attackers could theoretically use this to forge HTTPS certificates for any website and carry out man-in-the-middle attacks. Within hours of receiving the report on October 17, the two companies respectively used CRLSet and OneCRL to revoke trust in the relevant certificates. Users do not need to update or restart their browsers; Android devices have also received equivalent updates through Google Play services. Google stated that, before the revocation, no CT certificates linked to these CA were found in TLS logs. In addition, Chrome will remove emSign from its root certificate store starting at Pacific Time October 27.ECC Root CA ...
PANews stated that eMudhra's 8 intermediate CA certificates had private keys that were cracked due to flaws in the key-generation process and insufficient randomness.
02
The original article stated that attackers could theoretically use this to forge HTTPS certificates for any website and carry out man-in-the-middle attacks.
03
Google and Mozilla received the report on October 17 and, within hours, respectively used CRLSet and OneCRL to revoke trust in the relevant certificates.
04
The original article stated that users do not need to update or restart their browsers.
05
Android devices have received equivalent updates through Google Play services.
06
Google stated that, before the revocation,CT certificates linked to these CA were not found in TLS logs.
07
The original article stated that Chrome will remove emSign from its root certificate store starting at Pacific Time October 27.ECC Root CA。
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
Intermediate CA certificates can help issue website certificates. If their private keys are cracked, attackers could theoretically issue forged HTTPS certificates and impersonate websites. Google and Mozilla have revoked trust in the relevant certificates to prevent browsers from continuing to trust them.
Why it matters to readers
HTTPS Certificates are used to verify website identities. Compromised private keys create risks of website impersonation and man-in-the-middle attacks; rapid browser revocation can reduce the likelihood that these certificates will continue to be trusted.
According to the original text, ordinary users do not need to manually update or restart their browsers, and Android devices have also received the update through Google Play services.
Risks and unknowns
The original text states only that an attacker could theoretically carry out an attack; it provides no evidence that actual abuse has occurred.
Google stated only that, before the ban,CT no related TLS certificates were found in the logs; whether related certificates exist through other channels cannot be confirmed from the original text.
The main text is truncated with an ellipsis; the full explanation of Chrome's removal of the root certificate and the subsequent content are unknown.
The original text does not specify the year.
Related Developments
Loading event timeline…
Related concepts
Intermediate CA certificate
This term is not in the glossary yet. Browse related concepts in the glossary.
