Cloudflare tracks exploitation and patching of eMudhra's weak certificate keys

Cloudflare published a follow-up on the eMudhra certificate authority incident, in which eMudhra's certificate authority keys turned out to be weak. Cloudflare says it patched its outbound proxies within hours to reject the vulnerable keys, and an AI-assisted review of its source code found every other system that trusted them within four hours.

To check for active exploitation, Cloudflare added logging to its outbound proxy service, Pingora, and over about a week observed roughly 22,000 attempted handshakes using the weak eMudhra keys. Most were harmless test-site fetches, but about 160 handshakes stood out: they presented certificates naming domains unrelated to the site actually being contacted, some valid for over two years, which Cloudflare says looks like forged default certificates on consumer IoT-type devices rather than active interception attempts. One forged certificate was dated October 20 at 18:19 UTC, less than an hour after Mozilla's bug report went public.

To measure how many visitors still trust the weak keys, Cloudflare ran probe certificates through its challenge pages, collecting 50 million probes over a week. It found modern up-to-date browsers are mostly patched, but embedded browsers like Android WebView lag, with 30 to 40% still accepting the weak keys, and across large networks more than half of probes still accept the compromised certificate chain, with little further improvement after an initial weekend of patching. Cloudflare says it saw no evidence the weak keys were used to intercept its own connections.

Why it matters

It shows that even after a major certificate authority flaw is publicized and patched at the infrastructure level, a large share of real-world clients remain exposed for weeks.

Source: Cloudflare