Researchers have discovered eight TLS certificates issued by Indian certificate authority eMudhra that contain severely compromised cryptographic keys, allowing attackers to impersonate any site protected by them. The private keys possessed only 3 to 8 bits of entropy—despite using the P-384 elliptic curve, which should provide approximately 384 bits of security.
This massive weakness creates a straightforward path for certificate forgery. An attacker with knowledge of these weak keys could generate valid certificates for any domain, intercepting traffic and stealing credentials or data from users visiting the affected sites.
Major browsers and platforms have already responded. Chrome and Firefox have blocked the compromised keys, and protective measures have been deployed by Apple, Microsoft, Go, Python certifi, and Rust webpki-roots. However, remediation will lag significantly in Linux distributions, IoT devices, and Docker containers, leaving those systems vulnerable until patches propagate through their update cycles.