Eight eMudhra Certificates Got Compromised – How to Know If You’re Safe

TL;DR: A major security flaw in internet infrastructure has been found. Update your browsers, operating systems, and apps now. Check if you’re vulnerable below. At the bottom, a guide on what to ask your VPN provider and router maker.

Important: This article is general information, not professional security advice. The story is still developing. Use any information in this article at your own risk. The test below only checks your browser and was written by AI. I can’t guarantee its result. The rest of the article was written by me, not AI; proofread and fact-checked by me and AI.

What’s eMudhra?
A certificate authority.

What’s a certificate authority?
When you open a website, your browser asks it for something like an ‘ID card’. For example, when you connect to your online banking, you want to be sure it’s really your bank before you type in your password. A certificate authority (CA) vouches for the authenticity of that ID. There are many CAs around the world.

How does a CA vouch for a website’s identity?
It uses keys that are split into a public and private pair. It keeps the private part safe while sharing the public part with anyone, including browsers. It then signs a site’s ‘ID’ using the private key. Browsers can verify the signature using the public part.

A private key is like a stamp only the CA has. They use it to ‘stamp’ a website’s ID.

How do private keys stay secure?
They should be really hard to guess and kept safe from intruders. In this case, they were easy to guess: all eight keys were made of numbers lower than 256 (one byte). One was just the number 4 (!). That’s far too easy to guess. For comparison, private keys of this kind are usually numbers that are about 116 digits long.

How does a CA know someone really owns a website?
They issue a challenge only someone in control over the website could meet, like putting a secret word on the site or adding a note to the domain’s settings. To be sure, this process only proves who controls the address, not that the site is safe or its owner honest and reputable.

Say a website passes the test. Then what?
The CA issues a certificate, which is a small text file. It has the site’s name, its public key,¹ an expiration date, and the CA’s stamp on all of it. The website keeps this file on its server and sends it to every visitor.

How do visitors know the certificate is legitimate?
Their browser checks automatically. It keeps a list of all CAs’ public keys. If the certificate is signed with one of them, the browser trusts it.

Why eMudhra?
As far as we know, no one targeted eMudhra specifically. Instead, its keys were broken from the start. Again, private keys should be made of numbers so large no one could reasonably guess them. In this case, the numbers were tiny and easily guessable. It’s probably a mistake.

For now, no one knows how this mistake happened. It may have been sample code that ended up being used for real.

Who found this problem?
Someone who signed as ‘Wayne’. We don’t know more right now.

What can attackers do?
They can pose as a ‘man in the middle’ (MITM): they intercept your connection to the web and impersonate whatever website you connect to. Since they now have a trusted CA’s private key, they can send their own certificate in place of the real site’s. As always, the browser checks if the certificate was signed using a private counterpart of any of the public keys on file. That check will pass because the MITM has the private key – unless your browser is up to date, see below.

The MITM can then read every site you visit and everything you send. For example, if you open your online banking, they can read and steal your password.

What if the site’s real certificate was never signed using one of the compromised eMudhra certificates?
It doesn’t matter. Browsers generally don’t check which CA really signed any of the certificates: there are too many certificates and too many CAs. They typically only check whether at least one of the keys from all CAs was used to sign a certificate. They trust any CA to vouch for any site. If a browser has eMudhra’s public key on file, the check passes.

That’s why this incident is such a big deal: any site’s certificate can be spoofed this way even if eMudhra never signed its certificate.

Who could pose as a MITM?
It would have to be someone who sits between you and your website, like whoever runs your Wi-Fi, a rogue internet service provider (ISP), or a government. You should avoid public Wi-Fi at hotels, cafés, airports, etc., at least for now.

Has anyone been using this vulnerability quietly to spy on people since before it became known?
No one knows for sure. But so far, there are no signs of misuse. Every trusted certificate is supposed to be recorded in public logs. Those logs show no fakes.

But a careful attacker could skip the logs. Browsers such as Chrome and Safari would reject such a certificate, but many apps don’t check the logs.

Am I protected if I use a VPN (virtual private network)?
One would think so, and they usually do help, especially on public Wi-Fi. But in this case, some VPNs rely on the same list of trusted CAs to make sure they’re talking to the real VPN server, so they may accept fake certificates until they’re updated.

So an attacker, like a bad government or bad ISP, could pretend to be the VPN server, and then your trusted connection is compromised. However, updated browsers would still reject fake certificates. So the attacker would see what sites you visit, but not their contents or what you would otherwise have typed in.

VPNs that don’t use certificates, like WireGuard, shouldn’t be affected. Neither should VPNs with their own private certificates, like most OpenVPN setups.

Could a MITM trick people into installing faulty upgrades of apps?
Technically yes, but apps usually use signatures for upgrades. Those signatures use different keys. So your apps should automatically refuse any tainted upgrades downloaded over tampered connections.

Apps that don’t have signature checks are not safe, however.

Could this exploit be used to deanonymize people who otherwise stayed anonymous?
Yes. The government already knows who owns each home internet connection. If it poses as the VPN server, it can then see which sites you visit and, in apps that still trust the bad keys, what you enter.

Tor users don’t have this problem because Tor locks its tunnels with its own keys.

But the MITM would have to fool a user into establishing a connection?
No, the connection would happen automatically because the browser or VPN trusts the signature. The user wouldn’t necessarily notice anything.

Could past traffic be deanonymized?
No, not using this exploit. A MITM attack requires an active connection that’s being intercepted live.

How do I know if I’ve been exposed?
You can’t know if you’ve been exposed in the past. To be safe, change passwords on any website you’ve visited recently, but only after checking the next step.

How do I know if I’m currently vulnerable?
The test below shows you. If your browser still connects to sites whose certificates were signed with the compromised keys, your browser needs to be updated ASAP. If it doesn’t connect, then the test is inconclusive: a smart MITM could refuse to connect so you think you’re safe.

According to eMudhra’s official statement, none of the exposed keys “issued any end-entity certificates.” This statement still needs to be independently verified. Even if true, the same compromised keys could still trick outdated software.

When will browsers update?
Your browser likely already did update by itself. For this kind of thing, some browsers don’t even need to go through an update: they get an updated blocklist of rogue keys. At the time of writing, most major browsers have gotten an updated blocklist with those eight keys on it.

What else do I need to upgrade?
You should still update your operating system, browsers, and any other apps. Apple and Microsoft patched the issue in the background with blocklists. Linux distributions, however, go through regular updates, which can take longer.

It’s generally good practice to stay up to date across the board anyway. In particular, check for browser, VPN, and router updates. Make sure app publishers use signatures to verify updates. Otherwise, you may not be able to know that a MITM didn’t tamper with the updates.

What else can I do?
Contact your VPN provider. Ask them whether their app checks their servers against the public list of certificate authorities or with their own private certificates. If they use their own, they’re not affected. If it’s the public list, ask which version of their app blocks the eight compromised eMudhra keys. Finally, ask if their app updates are signed.

In addition, contact your router maker. Ask if the router checks certificates when it connects to their server, for updates or remote access. If so, ask which firmware version blocks the eight compromised keys, and how to check which version your router is on. Finally, ask whether the firmware is signed.