Eight secret keys at eMudhra, an Indian firm that vouches for websites, were compromised. Browsers and software makers are rushing out fixes
When a user visits a website, their browser checks a digital certificate to confirm the site is real. Companies called certificate authorities issue those certificates, and eMudhra is one of them. It has issued more than 60 million certificates, according to The Register.
Each certificate authority signs its certificates with a private key. Think of it as a master stamp. If someone steals or cracks that stamp, they can forge authentic-looking certificates for any website.As
Crypto users could also be affected, though mainly outside the browser. Exchange bots, trading scripts and wallet backends often run on Python, Node or Go, and a forged certificate for an exchange’s API could in theory let an attacker on the same network read or alter a bot’s traffic. No crypto attacks have been reported so far.
Browser makers and software developers have pushed out emergency fixes. Mozilla got the report just on Oct. 17 after 8 p.m. UTC and had a block in place about three hours later. Chrome blocked the certificates the same day. Apple followed on Oct. 19 and Microsoft on Oct. 20. eMudhra has also revoked them.
The exact mechanics of how this disaster happened were laid bare in Mozilla's Official Security Bulletin. Helme's reading of a Mozilla bug ticket says eMudhra blamed a bug in its key-setup script.
The real worry lies outside the browser. Many programs never check whether a certificate has been revoked. "So the fact that eMudhra and Sectigo have revoked these intermediates doesn't help them at all," Helme wrote.
He says his tests showed tools like curl, Python, Node, Go and Java accepted a forged certificate for Stripe's API. Fixes are out for Go, Python's certifi package and Rust's webpki-roots. Node.js was still pending when last checked.