Over half the web still trusts eMudhra's broken CA keys
Cloudflare confirms real forged certificates from eMudhra's weak CA keys, one minted less than an hour after disclosure, and finds most traffic still accepts the compromised chain a week on.
Cloudflare has confirmed active exploitation of the eMudhra CA keys disclosed on 19 October, the same compromise that got Chrome and Firefox to drop the issuer’s root certificates. Rather than generating a secure 115-digit signing key, eMudhra had picked small numbers like 4, 56 and 66 for eight of its intermediates, numbers anyone could guess and use to forge a certificate for any domain.
In the week since disclosure, Cloudflare logged around 22,000 handshake attempts using the weak keys. Two-thirds were fetches of test sites, but about 160 stood out as genuine forged certificates naming organisations and consumer IoT devices that had nothing to do with the requester. One was dated 20 October at 18:19 UTC, less than an hour after Mozilla’s bug report went public. Cloudflare also ran 50 million probes across its challenge pages and found that more than half still accept the compromised chain. Embedded browsers are worse: Android WebView still accepts it 30 to 40 percent of the time.
Why it matters: this has moved past a browser vendor being cautious. Attackers are actively minting forged certificates with the stolen keys, and most servers and embedded clients haven’t rotated away from the affected chain. If anything in your stack, including an in-app webview, still chains to an eMudhra intermediate, replacing that certificate is no longer optional.