Security teams worldwide are on high alert on Tuesday after researchers uncovered eight TLS certificates whose private keys are so weak they could let anyone create trusted browser and app credentials for any website. By late Tuesday morning, major browsers, several popular applications and programming language runtimes had already revoked all eight intermediate certificates. No certificate‑transparency logs have yet recorded any malicious use of the compromised keys, but the risk remains significant because updating other critical parts of the Internet, such as Linux distributions and embedded or Internet‑of‑Things devices, will be complex and time‑consuming.
The eight intermediate certificates are tied to the Indian certificate authority eMudhra Limited. An informal advisory posted on emudhra.we-have-a-problem.com on Tuesday contained the message “We have a problem here – Wayne,” which was digitally signed with the private key of one of eMudhra’s certificates. By demonstrating control of the key, the reporter forced defenders to act quickly, since the same key could be used to sign fraudulent certificates that would be trusted by millions of servers worldwide.