4 real? Tracking exploitation and patching of eMudhra’s weak keys

The discovery of these weak keys represents an unprecedented security breach in certificate authorities. Unlike previous incidents where compromised keys were contained, eMudhra's weak intermediate private keys can be recovered instantly from public certificates, allowing anyone to create fraudulent certificates for any domain that an unpatched client would accept.

Cloudflare's Response

Cloudflare acted swiftly, patching high-impact systems within hours of discovery. The company implemented AI-assisted analysis to identify all systems trusting the weak keys. "We started patching high-impact systems immediately on October 19," Cloudflare reported, including customer origin-facing proxies using Pingora.

Exploitation Evidence

Cloudflare detected approximately 22,000 attempted handshakes using the weak eMudhra keys over the following week. Two-thirds of these were test fetches, while most others involved origins using certificates signed with the weak intermediate. About 160 attempts stood out, with certificates naming other organizations' domains, including consumer IoT devices. One forged certificate was created just an hour after Mozilla's bug report became public.

Visitor Patching Status

Through 50 million probe connections, Cloudflare found that while modern browsers are mostly patched, bots and old browsers remain vulnerable. Embedded browsers like Android WebView show 30-40% still accepting the compromised keys. "Up-to-date modern browsers are mostly patched, but bots and old browsers are not," Cloudflare observed, noting little patching progress after an initial weekend response.

Next Steps

eMudhra announced they're exiting the public CA business, citing a mistake in key generation script but haven't shared the script. Cloudflare is working on industry-wide solutions like upki to enable quicker revocation and certificate transparency updates as vulnerabilities are discovered at an accelerating pace.