Guessable eMudhra Keys Sat Trusted for 18 Months; 30,800 Certificates Must Move

Eight certificate authority keys could be guessed in seconds. They sat in browser trust lists for about 18 months.

eMudhra, a Bengaluru company listed in India, runs a certificate authority under the emSign brand. On April 30, 2025, it created 24 intermediate certificates in one key ceremony, according to Mozilla’s Dennis Jackson in Bugzilla. Eight of them, the P-384 keys in what eMudhra calls the B and C series, came out broken.

“The 8 impacted keys all used integers less than 256,” Jackson writes. “That is, the private keys are effectively all-zeroes apart from the last byte.” A real P-384 key is a random number more than 100 digits long. Whoever holds an intermediate’s key can sign a certificate for any website, and browsers would accept it.

A researcher named Wayne emailed Apple, Chrome, Microsoft, Mozilla and eMudhra at 18:05 UTC on Saturday, October 17, with signed proof that he controlled all eight keys. On Mozilla’s mailing list he says he found the flaw with Google’s open-source Paranoid Crypto checker. Jackson says local AI agents recovered the keys “on their first attempt” with a one-line prompt about a capture-the-flag game.

eMudhra says one of the eight was in production and “had not issued a single certificate.” Google says no website certificate from the six TLS CAs appeared in Certificate Transparency logs before its block. That means a forged certificate could not have worked in Chrome or other browsers that enforce those logs, Google says.

Software outside the browsers is the open question. The test site’s operators say an attack on clients that skip the logs “would have been possible since the certificates were created in April 2025,” and that they do not know whether anyone tried. eMudhra says it is “not aware of any evidence” that the keys were recovered or exploited before disclosure.

The cleanup falls on universities, not on the weak keys.

Because the weak keys could sign anything, Mozilla and Chrome are removing trust in the root above them, emSign ECC Root CA - G3. The Chrome Root Program counted about 30,800 unexpired certificates chaining to it as of October 21. Of those, 23,806 came from InCommon’s OVG3C CA and 6,985 from DVG3C, both used by US research and education institutions. eMudhra’s own CAs issued 18.

eMudhra calls the impact “contained to a single customer ecosystem in the United States.” The University of Michigan told its IT staff that “some university websites and applications are, or will become, unavailable to visitors,” and that Cloudflare began rejecting the root on October 20.

eMudhra blames a key wrap and unwrap test step that created a second, weak set of keys, which were used by mistake because the labels were similar. It says it has “not yet confirmed the exact root cause.” Commenters on the Mozilla bug question how a certified hardware security module could produce such keys at all.

India’s CERT-In issued advisory CIAD-2026-0050, Mint reports, telling users to update browsers and trust stores and to replace affected certificates. A Ministry of Electronics and IT official told BusinessLine that impact on Indian sites was “limited and for a very short interval,” and that India’s digital signature and eSign services are unaffected. eMudhra’s shares fell more than 20% on Wednesday, BusinessLine reports.

On Thursday, eMudhra said its board “has decided to voluntarily withdraw from the global SSL/TLS certificate business,” which it says brings in about 1% of revenue. It says its RSA G1 roots will keep serving customers through the transition and it will replace affected certificates “free of cost from partners.” It did not name the partners.

Today’s Morning Feature, linked on the front page, explains certificate authorities and how browsers pull trust, with a timeline, a map of what is affected and a five-minute check.