eMudra intermediate certificates found to have exceptionally short private keys

The hosts described a second security problem involving intermediate certificates from certificate authority eMudra: some private keys were exceptionally short. One, a host said, consisted of the number 4; Sarah Guo’s post also mentioned the number 56. For comparison, the host said such keys are generally expected to contain hundreds of digits.

The hosts suggested that one of the keys may have been live for about a year and a half without attracting noticeable attention. According to the host, browsers had already blocked the bad certificates, but many servers, containers and devices still trusted them. He described the situation as a large-scale cleanup comparable in scale to Heartbleed, and outlined interception of connections and theft of personal or banking data as a possible scenario. The hosts did not say that such interception had already occurred.