Weak encryption certificates could have let hackers easily spoof websites

An Indian company’s serious error in creating high-level encryption certificates has prompted major web browsers to block the certificates before hackers can use them to spoof websites.

Certificate issuers use intermediate certificates to “sign” individual website certificates that assure users of the sites’ legitimacy and security.

Because it was trivially easy to break the encryption protecting eMudhra’s intermediate certificates, hackers could have weaponized them to sign fraudulent transport layer security (TLS) certificates that would let them impersonate major companies.

Cutting ties with flawed certificates Leading web browsers responded by severing their trust relationships with the eight weak intermediate certificates.

There is no evidence that hackers generated any fraudulent website certificates by exploiting the weaknesses in eMudhra’s keys.