eMudhra证书颁发机构八个中间证书私钥遭破解

安全研究人员发现eMudhra证书颁发机构的八个中间证书私钥存在严重缺陷，这些私钥仅由单字节数值组成，而非应有的384位随机数1。具体而言，这八个密钥的d值分别为4、56、115等极弱数值1，导致研究人员使用商用硬件在不足一秒内就恢复了所有密钥，最多只需255步计算1。

这一漏洞的成因源于eMudhra证书签署仪式脚本中的bug，该bug导致了弱密钥对的生成1。八个受影响的中间证书均在2025年4月创建，于5月被Sectigo的AAA证书服务根交叉签名1。2025年10月17日，安全研究人员向苹果、谷歌、微软、Mozilla和eMudhra报告了该漏洞；10月20日Mozilla公开宣布并随后更新NSS库，Chrome也更新了CRLSet1。

该漏洞影响范围极其广泛。Chrome和Firefox已直接阻止这些中间证书1，但curl、Python、Node、Go、Java、git等主流工具默认不检查证书透明性和吊销状态1。浏览器、非浏览器TLS客户端和IoT设备均可能受到冒充证书威胁1。特别是IoT、嵌入式设备和医疗设备等，由于其固件包通常冻结至2039年，使得这些证书的威胁将持续至其过期时间1。

在该漏洞公开前的17个月窗口期内，任何查看这些证书的人都可在毫秒内恢复私钥，但无法追溯是否被滥用1。

Security researchers have discovered that eight intermediate certificates issued by eMudhra, a certificate authority, contained private keys composed of only single-byte values instead of the cryptographically secure 384-bit random numbers they should have been 1. The private key components had d values of 4, 56, 115, and other single digits, drastically reducing the key search space and allowing researchers to recover all eight keys using commercial hardware in less than one second, requiring at most 255 computational steps 1.

All eight certificates were created in April 2025 and subsequently cross-signed by Sectigo's AAA certificate service root in May 1. eMudhra attributed the vulnerability to a bug in the certificate signing ceremony script that resulted in the generation of weak key pairs, describing it as human error involving the use of an incorrect key 1. The vulnerability remained exposed for 17 months, during which anyone examining these certificates could recover the private keys in milliseconds with no way to determine if the compromise had been exploited 1.

On October 17, 2025, security researchers reported the issue to Apple, Google, Microsoft, Mozilla, and eMudhra, leading to public disclosure on October 20 when Mozilla announced the discovery and updated NSS, while Chrome updated its CRLSet 1. Chrome and Firefox now directly block these intermediate certificates, but many non-browser TLS clients—including curl, Python, Node, Go, Java, and git—do not perform certificate transparency checks or revocation verification by default 1. The threat extends to IoT devices, embedded systems, and medical devices with frozen firmware packages that remain vulnerable until these certificates expire in 2039 1.