India’s cybersecurity agency CERT-In has issued
an advisory warning about a security compromise involving eight intermediate
digital certificate authorities linked to Indian company eMudhra. The flaw
could allow attackers to create fake security certificates for websites they do
not control, potentially enabling them to impersonate legitimate websites or
interfere with encrypted internet communications.
In its advisory dated October 21, CERT-In said
the affected private cryptographic keys were generated with insufficient
randomness, making them vulnerable to recovery. The agency has recommended
security updates, checks for affected certificates and changes to certificate
trust settings to reduce the risk. The incident involves TLS certificates,
which play an important role in securing websites and protecting information
exchanged between users and online services.
CERT-In has recommended several steps for
organisations, IT administrators and users whose devices or services may rely
on the affected certificates.
- Update browsers and software: Install the latest security updates for Firefox,
Firefox ESR and other affected browsers, applications and operating systems.
- Update certificate trust stores: Ensure devices, servers and applications
receive the latest certificate revocation and distrust information from their
respective vendors.
- Check certificate dependencies: Identify websites, applications and services
that rely on the affected intermediate CAs or the eSign ECC Root CA – G3
certificate.
- Replace affected certificates: Obtain replacement TLS certificates from a
trusted, unaffected certificate authority where necessary. Administrators
should also replace otherwise legitimate certificates that will no longer be
trusted by relevant clients.
- Verify TLS certificates: Check certificate chains, issuing authorities,
validity periods and revocation status. CERT-In has also advised against
bypassing certificate-validation warnings or disabling certificate
verification.
For ordinary users, keeping browsers and operating
systems updated is an important first step. Organisations that manage websites,
servers or enterprise applications should also check whether their systems
depend on the affected certificates and take corrective action where required.