Eight compromised eMudhra intermediate certificates could enable server impersonation and interception of traffic where affected certificates remain trusted.
Last reviewed
Updates
Cloudflare published follow-up research on forged certificates, client patching progress, and the limitations of its measurements.
Cloudflare updated its response and customer action table.
Cloudflare published the certificate-compromise response and recommended customer actions.
Overview
Details
A compromise of intermediate certificate authorities can allow an attacker holding a fraudulent but trusted certificate to impersonate a service or intercept traffic. The risk depends on whether a client or service still trusts the affected intermediates.
This is a certificate-trust incident, not a CVE-scored software vulnerability. It requires a different response: review trust stores and client software as well as applications and infrastructure that perform certificate validation.
Cloudflare's follow-up reports certificates forged using the weak keys and continued acceptance of affected chains among sampled clients. Forged certificates alone do not establish successful interception. The client measurements come from challenge-page traffic with a skewed, bot-heavy sample; they are not an Internet-wide patch-rate estimate.
Risk
Researchers found that some clients still accepted affected certificate chains, allowing forged certificates to pass validation.
Affected deployments
Clients and services that still trust the affected eMudhra intermediates. Check customer-managed trust stores, origins and mutual TLS configurations.
Recommended action
Apply the trust-store and client updates in the official response to systems that still trust the affected intermediates.
Identify customer-managed clients, origins, mutual TLS configurations, and container images that may trust the affected intermediates.
Apply the product-specific client and trust-store updates in the official response.
Review certificate-validation and outbound HTTPS paths that are not managed by Cloudflare.
Cloudflare coverage
Service status
As reported on 30 October, all high-priority Cloudflare systems were patched; lower-impact remediation remained in progress.
Product coverage
No WAF rules are applicable to this certificate-trust incident.
Evidence and sources
Incident response
Affected certificates and the actions required for each Cloudflare product.
Product guidance
Client releases and configuration guidance for Gateway and container HTTPS egress.
Exploitation and patching research
Measurements of affected certificate chains accepted by clients that execute JavaScript in Cloudflare challenge pages.