India’s cybersecurity agency CERT-In has issued an advisory warning about a security compromise involving eight intermediate digital certificate authorities linked to Indian company eMudhra. The flaw could allow attackers to create fake security certificates for websites they do not control, potentially enabling them to impersonate legitimate websites or interfere with encrypted internet communications.In its advisory dated October 21, CERT-In said the affected private cryptographic keys were generated with insufficient randomness, making them vulnerable to recovery.
The agency has recommended security updates, checks for affected certificates and changes to certificate trust settings to reduce the risk. The incident involves TLS certificates, which play an important role in securing websites and protecting information exchanged between users and online services.What is CERT-In advising users and organisations to do?
The govt drops an advisory on the eMudhra cybersecurity fiasco. CERT-In has recommended several steps for organisations, IT administrators and users whose devices or services may rely on the affected certificates.-Update browsers and software: Install the latest security updates for Firefox, Firefox ESR and other affected browsers, applications and operating systems. -Update certificate trust stores: Ensure devices, servers and applications receive the latest certificate revocation and distrust information from their respective vendors.-Check certificate dependencies: Identify websites, applications and services that rely on the affected intermediate CAs or the eSign ECC Root CA - G3 certificate. -Replace affected certificates: Obtain replacement TLS certificates from a trusted, unaffected certificate authority where necessary.
Administrators should also replace otherwise legitimate certificates that will no longer be trusted by relevant clients.-Verify TLS certificates: Check certificate chains, issuing authorities, validity periods and revocation status. CERT-In has also advised against bypassing certificate-validation warnings or disabling certificate verification.For ordinary users, keeping browsers and operating systems updated is an important first step.
Organisations that manage websites, servers or enterprise applications should also check whether their systems depend on the affected certificates and take corrective action where required.What is eMudhra and what does it do?eMudhra is an Indian digital security company that provides digital identity, authentication, electronic signature and certificate services. It issues digital signature certificates used by individuals and businesses for activities such as filing GST returns, submitting documents to government portals and signing documents electronically.
The company also provides SSL/TLS certificates used to secure websites and online communications. (eMudhra, Controller of Certifying Authorities)The company operates as a licensed Certifying Authority in India. Such organisations help establish trust in digital transactions by issuing certificates that verify identities.What went wrong with eMudhra's certificates?According to CERT-In, private keys associated with eight intermediate Certificate Authorities (CAs) were compromised because they had been generated using insufficient cryptographic randomness.
The advisory says the affected P-384 elliptic-curve private keys had exceptionally small values, allowing them to be recovered almost instantly.To understand the issue, it helps to know how digital certificates work. A TLS certificate helps a browser verify that a website is associated with the identity it claims to represent.
It also supports the establishment of an encrypted connection, helping protect information such as login details and payment data while it travels between a browser and a website.Certificates are issued within a system of trust. A root Certificate Authority sits at the top of this system, while intermediate CAs issue certificates under its authority.
Browsers and operating systems rely on this chain to decide whether a website's certificate can be trusted.If an intermediate CA's private key falls into the wrong hands, an attacker could potentially use it to issue fraudulent certificates for websites they do not own. A browser might then be tricked into trusting a fake website certificate, creating a risk of impersonation or interception of communications.Has anyone's data been stolen?The advisory warns about what attackers could do with the compromised keys, but it does not establish that users' passwords, financial details or other personal information have been stolen. eMudhra has stated that the affected intermediate CAs had not issued end-entity certificates, which are the certificates issued for individual websites or other specific entities.Google also reported that no TLS certificates chaining to the six affected intermediate certificates had been recorded in Certificate Transparency logs before its blocking action.
Certificate Transparency logs are public records that help security researchers and browser companies monitor the issuance of website certificates. These details are important when assessing the incident.
The compromised keys created a serious security risk, but the advisory does not confirm widespread exploitation or data theft.What have Google and Mozilla done?Mozilla blocked the six affected TLS intermediate certificates through its OneCRL certificate-blocking list. It also released Firefox security updates and updated its Network Security Services (NSS) certificate trust list to remove the root certificate that signed the affected intermediates.Google, meanwhile, blocked the public keys associated with the affected intermediates in Chrome through its Certificate Revocation List Set (CRLSet) update.
The changes are intended to prevent browsers from trusting certificates issued using the compromised keys. These measures are designed to stop the affected certificates from being used to establish trust in potentially fraudulent websites.- Ends