Eight Weak TLS Keys — and the Devices That Won't Get the Update
Eight TLS certificates have surfaced with private keys so weak that anyone holding them could mint trusted browser and app credentials for any site on the internet. All eight are intermediate certificates, and they belong to eMudhra Limited, a certificate authority based in India. So far, the certificate transparency logs that track all browser-trusted certificate issuance show no misuse of those keys, according to Ars Technica.
The danger lingers for a duller reason: fixing the rest of the internet is a slog. Linux distributions, embedded systems and internet-of-things devices will be hard and time-consuming to update. That is the least glamorous half of security work, and it is the half that decides how long a scare like this one rumbles on.
AI-generated discussion · Different perspectives
Browser makers and some major apps and programming languages had blocked all eight certificates. Blocking is the fast half; the same report notes the Linux distributions and embedded and IoT devices on the other side of this will take far longer to update.
Defenders scrambled because the same key could sign unauthorized certificates that millions of servers worldwide would trust. No malicious use showing up in the logs is a relief, not a warranty.