According to Cointelegraph, tech companies are moving quickly to block eight eMudhra-issued digital certificates that contain a private key generation flaw. The flaw enables anyone to guess the associated keys, allowing them to create fraudulent HTTPS certificates for websites impersonating legitimate domains.
The issue concerns the mechanism used by eMudhra to generate private keys for its digital certification service. Due to the vulnerability, an external party could derive valid keys without access to protected systems or credentials. This capability would permit the issuance of SSL/TLS certificates that appear authentic to browsers and users, facilitating website spoofing.
Multiple technology firms have initiated actions to revoke or prevent use of the affected certificates. Their response aims to reduce risk before malicious actors exploit the flaw to host counterfeit versions of trusted sites. No timeline for full revocation was provided, nor were specific company names mentioned in reporting.
The discovery prompted urgent internal reviews at the involved companies regarding certificate validation processes and distribution channels. Efforts focus on ensuring only correctly issued and verified certificates remain valid for domain authentication.
This development highlights ongoing scrutiny of third‑party certification practices when cryptographic weaknesses are identified. Stakeholders emphasize the need for rapid, coordinated action to protect users from site impersonation.
