Cloudflare tracks forged certificates from eMudhra’s weak CA keys
Original title: 4 real? Tracking exploitation and patching of eMudhra’s weak keys
About 22,000 handshakes presented the weak keys; Cloudflare says none intercepted its own connections.
Cloudflare says eMudhra intermediate private keys corresponding to the public values 4, 56, 66, 115, 155, 156, 230, and 237 can be recovered from the certificates themselves, so anyone can mint certificates unpatched clients may accept. Cloudflare began rejecting the keys on high-impact systems on October 19 and logged about 22,000 related handshakes after October 21. Most were test sites or origins that issued certificates for themselves. About 160 named unrelated domains, including some consumer IoT names, but Cloudflare says they looked like servers’ default certificates, not interception.
Unconfirmed: Cloudflare says the unusual certificates looked like origin defaults, not interception, and eMudhra has not released the generation script.
- One forged certificate was dated October 20 at 18:19 UTC, under an hour after Mozilla’s public bug report.
- Two-thirds of the 22,000 handshakes were fetches of test sites such as emudhra.we-have-a-problem.com.
- Some forged certificates were valid for over two years, longer than public CAs may issue.
- eMudhra says it is exiting the public CA business and blames a key-generation script it has not shared.
- High-priority Cloudflare systems are patched; a few low-impact tickets remain.
Impact: Anyone can forge certificates unpatched clients may accept
| Product | Affected |
|---|---|
| eMudhra public CA intermediate keys | 4, 56, 66, 115, 155, 156, 230 and 237 |
- 1.Reject the listed weak eMudhra intermediate keys on TLS clients and proxies.
- 2.Require Certificate Transparency so certificates from these keys are not trusted.
- Vendors
- eMudhraCloudflare
- Products
- Pingora
- Organizations
- Mozilla
From the original article
7 min read at blog.cloudflare.com
Four, just four: that’s the key to break into any unpatched connection on the Internet that is using eMudhra certificates. Here’s how we quickly patched Cloudflare, what evidence we can see of attempted exploitation, and how much of the rest of the Internet remains exposed.
By Maxime Guerreiro · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.