The week PHP2Shell had governments pulling websites offline, a quieter failure was sitting underneath the web’s trust system. Eight intermediate certificate authority keys from eMudhra, an Indian CA trusted by every major browser, were generated so badly that anyone could compute them from the public certificates. One of the private keys was the number 4. The others were all numbers below 256. For 17 months, anyone who looked closely could have forged a trusted certificate for any website on the internet.
The coverage has split two ways. One camp says the story is over. Chrome and Firefox blocked the certificates within hours of the report and before the public knew. Certificate Transparency logs show no forged certificates, and nobody has reported misuse. The other camp points out that a mainstream interception tool now ships one of the keys, and that most software outside the browser never checks revocation at all. Both camps have the evidence on their side. They’re answering different questions.
This analysis takes both seriously. It explains why browser users are very unlikely to have been hit, and why build pipelines, container images, API clients, Red Hat servers and embedded devices are a different story. Some of those devices will trust the bad chain until 2039. It also covers the problem nobody can solve right now: a certificate forged offline and used against software that skips the checks leaves no public trace. “No reported misuse” means less here than it sounds.
The bill also lands on people who did nothing wrong. Chrome removes eMudhra’s root on October 27, which strands about 30,800 legitimate certificates. Almost all of them belong to US universities that moved to eMudhra through InCommon only this summer. Many are reissuing on another eMudhra root, and that root may not last either now that the company has announced it’s leaving the business. If you run IT anywhere, read this for the checklist. If you think about how trust is built and audited, read it because two audit cycles missed a key whose value was 4.
About the Author
