The Internet goes on high alert after discovery of 8 compromised TLS certs
ars ·
Security personnel worldwide are on high alert following the discovery of eight compromised TLS intermediate certificates issued by India-based eMudhra Limited. The private keys associated with these certificates were found to be critically weak, ranging from 3 to 237 bits, which is far below the standard 384-bit entropy for NIST P-384 elliptic curve cryptography. This vulnerability allows anyone to mint trusted browser and application credentials for any site on the Internet, posing a severe risk to digital security. Major browsers have already blocked the affected certificates, although some updates for Linux distributions and IoT devices remain pending. Cryptography experts compare the scale of the required cleanup to the Heartbleed incident, noting that the heterogeneity of systems involved will make recovery particularly time-consuming. While no malicious usage has been reported in certificate transparency logs yet, the threat remains active until all dependent systems are updated. Users are advised to exercise caution with non-browser TLS communications, especially when using VPNs in regions with aggressive surveillance. The incident highlights the fragility of the TLS ecosystem, where a single weak link can compromise global trust infrastructure.
ars