Google, Mozilla revoke eMudhra intermediates after private key compromise
Summary
The private keys for eight intermediate certificate authorities operated by Indian digital trust provider eMudhra have been compromised. This breach potentially allows attackers to forge trusted certificates and impersonate websites or services. Google and Mozilla have taken action by revoking these intermediates.
IFF Assessment
The compromise of private keys for certificate authorities poses a significant risk to trust and authentication on the internet, enabling impersonation and potentially widespread fraud.
Defender Context
This incident highlights the critical importance of Certificate Authority (CA) security and robust key management practices. Defenders should monitor for any signs of certificate anomalies or impersonation attempts related to eMudhra-issued certificates and ensure their systems are updated to trust only legitimate certificate chains.