eMudhra Weak Keys Enable Widespread Certificate Forgery
The eMudhra certificate authority (CA) recently disclosed an unprecedented security incident involving eight astonishingly weak private keys. Unlike previous CA compromises where key access was contained, these intermediate private keys could be recovered almost instantly by anyone from the public certificates themselves. This fundamental flaw allows for widespread certificate forgery, posing a significant threat to internet trust and security. According to Cloudflare, the potential consequences are severe for any unpatched client not enforcing Certificate Transparency.
The compromised keys included shockingly simple numerical values such as 4, 56, 66, 115, 155, 156, 230, and 237. These values were used where complex, high-entropy numbers (e.g., 115-digit numbers) were expected for cryptographic strength. This allows any attacker to independently recover the signing keys and create fraudulent certificates for any domain, which would be accepted by unpatched clients.
Technical Details of the eMudhra Weak Cryptographic Keys
The eMudhra incident differs significantly from past CA compromises, such as those affecting DigiNotar, TÜRKTRUST, or TrustWave. In those cases, attackers typically gained limited access to CA infrastructure, enabling them to issue a finite number of fraudulent certificates. The eMudhra scenario, however, makes the vulnerable intermediate private keys publicly available, meaning anyone can recreate them. This transforms a targeted compromise into a widely accessible cryptographic flaw. eMudhra has announced its exit from the public CA business, attributing the issue to a key generation script mistake, though details on the script or the role of auditors remain unclear.
Cloudflare’s internal response to the discovery on October 19 involved immediate patching of high-priority systems, including customer origin-facing proxies using Pingora, within hours. An AI-assisted analysis identified all other systems trusting these weak keys. To track potential exploitation, Cloudflare implemented logging on Pingora, which handles most outbound TLS connections. Over a week, approximately 22,000 attempted handshakes with the weak eMudhra keys were detected. While many were linked to test sites, about one-third involved origins seemingly setting up certificates for themselves using the weak intermediate keys.
Crucially, Cloudflare’s patched systems refused all handshakes configured to verify the certificates. However, about 160 handshakes involved certificates whose Subject Alternative Names (SANs) listed domains unrelated to the requested Server Name Indication (SNI). Some of these forged certificates were observed as early as October 20, less than an hour after Mozilla’s bug report became public, confirming that the keys were used to forge certificates almost immediately after the weakness was public. While Cloudflare observed no evidence of these weak keys being used to intercept its connections, the widespread availability and immediate use of forged certificates indicate a critical threat to the broader internet.
Mitigating eMudhra Certificate Forgery and Detecting Unpatched Clients
Organizations must prioritize patching and configuration adjustments to protect against this threat. Cloudflare, for instance, implemented indirect methods using challenge pages and probe connections to ca1.cloudflarecaptcha.com and ca2.cloudflarecaptcha.com to assess if visitors still trusted the weak keys without breaking connections. This highlights the difficulty in determining the scope of vulnerable clients externally.
Key recommendations for organizations include:
- Update Trust Stores: Ensure that all operating systems, browsers, and applications have updated their trust stores to explicitly distrust the weak eMudhra intermediate certificates. This is the most direct way to prevent acceptance of forged certificates.
- Enforce Certificate Transparency (CT): Clients configured to enforce Certificate Transparency will typically reject certificates that have not been publicly logged. This serves as a vital secondary defense against fraudulently issued or compromised certificates.
- Monitor TLS Traffic: Implement deep packet inspection or TLS interception solutions to identify any attempts to present certificates signed by the known weak eMudhra keys within your network.
- Review Certificate Policies: For organizations operating their own Public Key Infrastructure (PKI) or relying on specific CAs, review issuance policies and key generation practices to prevent similar cryptographic weaknesses.
The widespread and instantaneous availability of the eMudhra weak keys makes this a critical, ongoing threat. Proactive patching and enforcement of cryptographic best practices are essential for maintaining a secure online environment.
Related: eMudhra Intermediate CA Keys Compromised: Cryptographic Defect Analysis, Cloudflare Account Abuse Protection Dashboard Released