Cloudflare reports 22,000 attempts involving eMudhra’s weak certificate keys

Cloudflare says it has seen about 22,000 attempted connections involving weak eMudhra certificate keys, and its measurements suggest many visitors may still trust the compromised chain. The company says its high-priority systems have been patched, but the wider picture is less reassuring.

Cloudflare Watch analysis

What happened

The keys, Cloudflare says, were weak enough to be recovered from public certificates. That could let someone create certificates for domains that an unpatched client might accept. In a new follow-up, Cloudflare describes how it patched its systems and what its monitoring found.

After adding logging to its Pingora service, Cloudflare recorded about 22,000 attempted handshakes with the weak keys in the following week. It says every handshake configured for certificate verification was refused. Around 160 certificates named organisations unrelated to the requested connections, but Cloudflare says these appeared to be servers’ own default certificates and would have failed hostname checks. It has seen no evidence so far that the keys were used to intercept its connections, while noting that carefully targeted interception cannot be ruled out.

Cloudflare also used probes on a sample of challenge pages to estimate whether visitors still accepted the compromised chain. It says more than half of probes across large networks continued to accept it. The company warns that this sample is skewed by bot traffic and changing traffic classifications, so it is suggestive rather than a reliable count of vulnerable people or devices. Its results indicate that some embedded browsers, including Android WebView, lag behind, with 30–40% still accepting the chain in the measured traffic.

Why it matters

A certificate problem is only fixed when the software checking certificates stops trusting the bad keys. Cloudflare’s measurements suggest that patching its own systems is not the same as closing the wider gap, especially where older or embedded software is involved. The numbers are not a census, but they are a useful warning that a patch announcement and a patched internet are different things.

Our read

The practical advice is unglamorous and correct: update browsers, operating systems and embedded software, and follow the relevant guidance if you operate affected systems. Cloudflare says its own high-priority systems are patched; its visitor measurements are more uncertain, and should be read as a warning signal rather than a headcount. Security rarely offers a satisfying single switch. This time, the switch is still called “update”.

What to watch

• Whether Cloudflare’s measurements show further patching as the traffic mix stabilises.
• Whether browser and operating-system vendors publish further guidance on the affected keys.
• Whether Cloudflare reports evidence of attempted interception or other confirmed misuse.

Discussion spark: When a certificate authority’s keys are this weak, should browser and operating-system vendors force a faster trust-store update, even if that risks breaking older devices?

not affiliated with or endorsed by Cloudflare