search
TLS certificates
Trends
- 1Weak private keys found in eight eMudhra TLS certificates●MAJOR INTERNET SECURITY SCARE AS 8 TLS CERTIFICATES FOUND WITH EXTREMELY WEAK PRIVATE KEYS Eight security certificates i
Eight TLS certificates issued by India-based certificate authority eMudhra have been found with private keys so weak that attackers could potentially forge them and impersonate virtually any website, prompting a major internet security scare. The findings raise concerns over the certificate authority's key-generation practices and whether browsers and security firms will move to revoke or distrust the affected certificates.
- 2Go to reject certificate chains with eight distrusted SPKIs●Go will reject certificate chains containing eight distrusted SPKIs
The Go project has decided that its cryptographic stack will reject TLS certificate chains containing any of eight specific distrusted SPKIs (subject public key identifiers). The change, tracked in an issue on the Go repository, means Go programs will refuse connections whose server certificates chain back to these keys, even if a chain to a trusted root could otherwise be built. It follows earlier moves by browser and platform vendors to hard-fail on known-bad keys.
- 3
A report has surfaced alleging that an intermediate certificate authority belonging to Indian digital certificate provider eMudhra has been compromised. If confirmed, the claim would have serious implications for the trustworthiness of certificates issued under that authority, potentially affecting websites and services that rely on them. eMudhra, which issues TLS certificates as a publicly trusted CA, has not issued a public confirmation of the incident, and the full extent of the alleged breach remains unclear.