Cloudflare's eMudhra postmortem: 22K weak-key handshakes in a week, patching stalls
Cloudflare Blog · rss · 2026-10-31
Cloudflare published an in-depth follow-up on India-based CA eMudhra's eight shockingly weak intermediate keys (one was literally the number 4), which anyone could recover almost instantly from public certificates and use to forge certificates for any domain — unprecedented in CA history.
Key findings:
- Cloudflare patched high-priority systems within hours and used AI-assisted source code analysis to map every system trusting the weak keys in four hours
- About 22,000 handshakes with the weak keys were observed in a week; roughly 160 carried certificates naming other organizations' domains (including consumer IoT), some valid for over two years. The earliest forged certificate appeared less than an hour after disclosure, though no evidence of interception of Cloudflare traffic was found
- 50 million probes show modern browsers are mostly patched, but bots, old browsers, and embedded browsers like Android WebView lag with 30–40% still accepting, with little patching progress after the first weekend
eMudhra is exiting the public CA business, blaming a key-generation script mistake it has not shared; Cloudflare calls for clarity on auditors' and cross-signers' roles.
More from Infra
- AI scarcity moved to atoms: memory, GPU and wafer margins hit 58%-80% — sujingshen · 2026-10-31
- Anthropic's S-1 risk factors: compute tops the list at 13.4%, edging out regulation — ayushtweetshere · 2026-10-31
- TU Eindhoven shows glass interposer with BGA below and MPO optical port on top — jwt0625 · 2026-10-31
- AI Boom Triggers Massive PCB Shortage With Orders Booked Until 2030 — chemist_slime · 2026-10-31
- Beff Jezos doubles down on Cerebras: GPU backends feel 'stupid' for frontier-scale fast inference — beffjezos · 2026-10-31
- Intel Arc B580/B70 ComfyUI Benchmarks: omnixpu Beats Native pytorchxpu — Willing-Grade5566 · 2026-10-31