一家总部位于印度的认证机构（CA）使用了极其简单的私钥，导致私钥泄露，这意味着其签发的超过 6000 万张证书无法被信任，并引发了一场大规模的清理工作。
Tragically simple private keys used by a certification authority based in India have been compromised, meaning the 60-million-plus certs it has issued can’t be trusted and necessitating a massive clean-up job.
涉事的 CA 名为 eMudhra，该公司自称已签发超过 6000 万张数字证书，助力构建一个数字信任的世界。然而，该公司却让全球陷入了恐慌。
The CA of concern in this case is called eMudhra, which boasts of having issued over 60 million digital certificates to help usher in a world of digital trust. The company has instead panicked the world.
关于该公司失误的消息于周二出现在 Mozilla 密码工程团队成员 Dennis Jackson 的一篇帖子中。他写道：“10 月 17 日周六 20:06 UTC，Mozilla 收到一位社区成员的报告，称与八张 eMudhra 中间证书相关的私钥已被泄露。这些密钥可能允许攻击者为其不控制的网站签发欺诈性的 HTTPS 证书。”
News of the company’s errors appeared on Tuesday in a post by Dennis Jackson, a member of Mozilla’s cryptography engineering team. “On Saturday, October 17, at 20:06 UTC, Mozilla received a report from a community member that private keys associated with eight eMudhra intermediate certificates had been compromised,” he wrote.
Cloudflare 则表示：“攻击者可以为任何域名创建伪造证书，并利用它冒充服务器以拦截或修改流量。”
“These keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control.”
Jackson 随后详细阐述了该事件及应对措施，值得庆幸的是，Mozilla、Chrome 和 Apple 已修复该问题，使其浏览器不再依赖这些证书——至少在用户安装更新后是这样。他还报告称，eMudhra 已吊销了这些证书，并列出了许多已发布更新的自由开源软件（FOSS）项目，这意味着它们将不再识别来自 eMudhra 的证书。
Or as Cloudflare put it, “an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic.”Jackson has since elaborated on the incident and the response, which has thankfully seen Mozilla, Chrome, and Apple remediate the issue so their browsers won’t rely on the certificates – at least after users install an update.
这是个好消息，但遗憾的是，使用这些私钥签名的证书仍然存在，且许多服务依赖它们。浏览器厂商已设置为检测并拒绝不良证书。但其他依赖这些证书的方可能不具备这种能力，很可能需要深入排查其环境，以确认是否依赖由 eMudhra 签名的证书。开发者 Geoffrey Huntley 提供了一些关于自动化该过程的建议。
He also reports that eMudhra has revoked the certs, and lists many FOSS projects that have issued updates that mean they won’t recognize certs from eMudhra. That’s welcome, but sadly certs signed with these private keys are still out there and many services rely on them. Browser makers are set up to detect and reject bad certs. Others who relied on them may not be, and will likely need to dig into their environments to see if they rely on certs signed by eMudhra.
截至发稿时，eMudhra 尚未就该事件及其安全实践回复《The Register》的询问。
Developer Geoffrey Huntley has offered some advice on automating that process.
后一个问题备受关注，因为安全研究员斯科特·赫尔梅（Scott Helme）分析了 eMudhra 的证书，发现其使用的一个私钥“就是数字 4”。“不是以 4 开头的数字，也不是 4 后面跟着几百位随机数字，就是 4……另一个是 56，还有一个是 115。我知道这些，因为我刚刚在笔记本电脑上从它们的公开证书中恢复出了所有这些私钥，耗时不到一秒，”赫尔梅写道。
At the time of writing, eMudhra has not responded to The’s inquiries about the incident and its security practices. The latter question is of great interest because security researcher Scott Helme analyzed eMudhra’s certs and found one the private keys it used “is the number 4.”
其他研究人员还发现了包含数字 66、155、156、230 和 237 的私钥。这些私钥极其不合格，因为它们很容易被猜到，导致 eMudhra 签发的所有证书都容易遭受暴力破解攻击。正如赫尔梅所言：“P-384 私钥应该是一个随机的 384 位数字，这会给你 2³⁸⁴ 种可能性（大约是 10¹¹⁵），所以没有人会去搜索那个空间。” 事态仍在发展中，本刊将在获得更多信息后更新报道。 ®
“Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second,” Helme wrote. Other researchers have found private keys including the numbers 66, 155, 156, 230 and 237. Those are vastly inadequate keys, because they’re easy to guess, making all certs issued by eMudhra susceptible to brute force attacks. As Helme put it: “A P-384 private key should be a random 384-bit number, which gives you 2³⁸⁴ possibilities (or roughly 10¹¹⁵), so nobody is ever going to search that.”This is a developing story and The will update it as more information becomes available. ®