8 eMudhra certificates are compromised. Here's what you need to know
Curated from Cloudflare Blog
This incident highlights a persistent blind spot in certificate lifecycle management: the assumption that CA-issued intermediates are inherently secure. Eight eMudhra certificates compromised via weak keys force a critical re-evaluation of how we validate trust chains. For SREs, this is not just a theoretical risk; it demands immediate action to update client libraries and verify TLS configurations. Relying solely on browser or OS trust stores without independent verification of intermediate key strength leaves your infrastructure exposed to potential man-in-the-middle attacks. Takeaway: Audit your TLS termination points and load balancers to ensure they explicitly reject certificates with weak key parameters, rather than relying on default trust store behavior.
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next.
— Cloudflare Blog