What the new telemetry shows
Cloudflare reports about 22,000 attempted handshakes involving the weak eMudhra keys in its outbound TLS telemetry. Many were test sites or origins presenting their own certificates, so the count is not a count of interceptions. Cloudflare says certificates apparently forged after disclosure were observed, but it has no evidence of interception of its own connections so far.
This is a material change from the first article, which reported the issuer’s statement that the weak intermediates had not issued publicly trusted end-entity certificates and did not assert observed forgery. A certificate made with a recoverable private key after disclosure is a different claim from legitimate issuance by the CA.
Where trust remains uneven
Cloudflare’s challenge-page probes suggest that some embedded browsers, including Android WebView, still accept affected chains. The sample is influenced by bots and changing probe conditions, so it cannot establish the share of all clients that remain exposed.
The issuer says the eight weak intermediate authorities were revoked and its root key was not compromised. Certificate migration and client trust-store updates remain separate tasks. Operators should check the chains and clients they actually use rather than assuming all eMudhra certificates share the weak key.
What remains unresolved
Cloudflare’s observations do not prove targeted interception, and eMudhra’s investigation says it found no infrastructure or customer-data compromise. Neither statement rules out every misuse of a recoverable signing key.
Preserve certificate chains, trust-store versions and connection evidence if an unexpected certificate appears. Prioritize updates where affected chains remain accepted, and verify that replacement certificates work across clients.
Evidence and review
Incident date: Unknown. Evidence checked .
Merged by pankajmouriya · Editorial merge