Eight Keys Under 256: The eMudhra Certificate Failure, Explained

The short version. For about 18 months, eight certificate authority keys at eMudhra, an Indian digital-trust company, were so weak that anyone could work them out. A researcher showed it on Saturday, October 17. Browsers blocked the keys within hours. The cleanup is the hard part: about 30,800 working website certificates chain to the same root, and Chrome stops trusting that root on Tuesday, October 27. On Thursday, October 22, eMudhra said it will leave the global website certificate business.

At a glance

	What we know	Source
What broke	8 intermediate CA keys, generated April 30, 2025, were numbers below 256	Mozilla, bug 2083449
What they cover	6 for websites (TLS), 2 for code signing; Sectigo cross-signs reuse the keys	Mozilla; Chrome Root Program
Customer certificates from the weak CAs	None, eMudhra says	eMudhra
Certificates that must move	About 30,800 chain to the distrusted root; eMudhra estimates 30,000	Chrome Root Program; eMudhra
Who holds most of them	Two InCommon (Internet2) CAs: 23,806 and 6,985	Chrome Root Program
Exposure window	About 535 days, from April 30, 2025 to October 17, 2026	eMudhra; Mozilla
Blocked in Chrome and Firefox	October 17, within about 3 hours of the report	Google; Mozilla
Root removed	Mozilla: October 20. Chrome: morning of October 27, PDT	Mozilla; Google
India's signatures and eSign	Unaffected, say eMudhra and India's IT ministry	eMudhra; BusinessLine
Status	Open. Root cause unconfirmed; root-program questions unanswered; eMudhra exiting global TLS	bug 2083449; eMudhra

What happened

Every padlock in your browser rests on a chain of signatures. At the top sits a root certificate your device already trusts. Below it are intermediate certificates, which sign the certificates websites use. Whoever holds an intermediate's private key can sign a certificate for any website.

eMudhra, a Bengaluru company listed in India, runs a certificate authority under the emSign brand. On April 30, 2025, it held a key ceremony that created 24 intermediate certificates, Mozilla says. Eight of them, the P-384 keys in what eMudhra calls the B and C series, came out broken.

How broken? A P-384 private key should be a random number more than 100 digits long. Mozilla's Dennis Jackson writes that all eight "used integers less than 256." That is, the keys "are effectively all-zeroes apart from the last byte." Anyone could recover them by trying the first 256 possibilities. One of them was literally the number 4, Security Brigade CTO Yash Kadakia told BusinessLine.

On Saturday, October 17, at 18:05 UTC (11:05 AM Pacific), a researcher named Wayne emailed Apple, Chrome, Microsoft, Mozilla and eMudhra. He attached signed proof that he controlled all eight keys. On Mozilla's mailing list, he says he found the break by running Google's open-source Paranoid Crypto checker over the public database of CA certificates.

The extent: who and what is affected

There are two separate problems, and they hit different people.

Problem one: the weak keys. Six of the eight intermediates were for websites, trusted by Chrome, Mozilla, Microsoft and Apple, Mozilla says. Two were for code signing, trusted by Microsoft. eMudhra had also sent the weak keys to Sectigo, which cross-signed them in May 2025. That created more certificates sharing the same keys. Sectigo revoked its cross-signs on October 19.

The good news is about use. eMudhra says seven of the eight were never used in production. It says the eighth "had not issued a single certificate." The keys were meant for its US and European data centers, eMudhra wrote, "to solve data sovereignty issues for some of our customers."

Problem two: the root. Because the weak keys could sign anything, Mozilla and Chrome decided to stop trusting the root above them, emSign ECC Root CA - G3. That root also sits above working certificates that real websites use.

The Chrome Root Program counted them in public Certificate Transparency logs. As of October 21, about 30,800 unexpired certificates chained to that root. Almost all came from two InCommon CAs run by Internet2, which serves US research and education: 23,806 from "OVG3C" and 6,985 from "DVG3C." eMudhra's own CAs issued 18. eMudhra's estimate is "about 30,000 certs," 97% of them issued automatically through ACME.

eMudhra describes the damage as "contained to a single customer ecosystem in the United States." The University of Michigan, an InCommon member, warned that "some university websites and applications are, or will become, unavailable to visitors." It said the affected certificates are CERTInext certificates with ECC keys from those InCommon CAs. Its alert says InCommon certificates issued through Sectigo are unaffected. RSA certificates from CERTInext are "not currently affected," it says, but could be later.

What is outside the blast radius. eMudhra is also a licensed certifying authority for Digital Signature Certificates under India's IT Act. It says that business, its eSign service and its software products run on separate infrastructure and are unaffected. A Ministry of Electronics and IT (MeitY) official told BusinessLine the same. Mozilla says it is keeping trust in eMudhra's RSA root, emSign Root CA - G1, "at this time."

Money and markets. eMudhra says the global TLS business is about 1% of its revenue. Its shares still fell more than 20% to the lower circuit on Wednesday, BusinessLine reports. MeitY set up a special team to investigate, CNBC-TV18 reports, and CERT-In, India's cyber agency, issued advisory CIAD-2026-0050.

The duration: 535 days exposed, 3 hours to block

The weak keys existed from April 30, 2025, and eMudhra says the hierarchy entered browser trust lists in mid-2025. They were found on October 17, 2026. That is about 535 days, through what eMudhra calls "two independent audit cycles." The test site's operators say an attack on software that skips the public logs "would have been possible since the certificates were created in April 2025."

There was an early warning. In June 2025, in Mozilla bug 1970728, eMudhra reported that revocation lists for the six website CAs had invalid signatures. It now says those lists were first signed with the original strong keys, which did not match the certificates. "They were resigned with flawed keys," eMudhra's Naveen Kumar ML wrote. Mozilla had asked how the wrong keys came to sign those lists. Another commenter now asks whether the 2025 bug was shown to eMudhra's auditors.

Once reported, the response was fast:

When (UTC)	Pacific	What happened	Source
Oct 17, 18:05	11:05 AM	Report reaches Apple, Chrome, Microsoft, Mozilla, eMudhra	Wayne, bug 2083449
Oct 17, 19:45	12:45 PM	Chrome blocks the six website keys through CRLSet, which covers the cross-signs too	Chrome Root Program
Oct 17, 21:28	2:28 PM	eMudhra acknowledges and disables its one live CA	bug 2083449
Oct 17, 21:48	2:48 PM	Mozilla recovers the keys itself, "without any tips"	Mozilla
Oct 17, 22:59	3:59 PM	Firefox block complete through OneCRL	Mozilla
Oct 18, 09:24 to 09:38	2:24 to 2:38 AM	eMudhra revokes all eight, reason "CA compromise"	eMudhra, bug 2083449
Oct 19		Apple devices block the keys; Android gets an update via Play Services; Sectigo revokes its cross-signs	test site; Google; Sectigo
Oct 20		Microsoft blocks; Mozilla removes the G3 root in NSS 3.131.1 and ships Firefox 158.0.1; Cloudflare starts rejecting the root, breaking some Michigan sites	test site; Mozilla; Michigan
Oct 21		CERT-In advisory; eMudhra statement; Node.js ships the block	CERT-In via Mint; eMudhra; Node.js
Oct 22		eMudhra's board decides to leave the global SSL/TLS business	eMudhra
Oct 27, morning PDT		Chrome Root Store 43 drops the G3 root for all users	Google

Is it over? No. Mozilla's bug is still open. The Chrome Root Program filed a long list of questions to eMudhra on October 21, and they are unanswered. Chrome says it is "closely investigating the ongoing inclusion" of eMudhra's remaining roots. eMudhra says it will reverify "every key ceremony we have done" over the next week.

October 22: eMudhra leaves the business

On Thursday, eMudhra said its board "has decided to voluntarily withdraw from the global SSL/TLS certificate business." Chairman V. Srinivasan blamed "social media amplification" that brought "scrutiny that is out of proportion" to a line worth about 1% of revenue.

The release says the RSA G1 roots "will continue to serve customers until this transition is complete." eMudhra says it will replace affected certificates "free of cost from partners." It promises a full root-cause report to the browser programs. It does not name the partners, the roots or a date, and a commenter on the Mozilla bug has asked for all three.

How it happened

eMudhra's account, in bug 2083449 and on its status page, goes like this. The keys were made inside Utimaco hardware security modules (HSMs) certified to FIPS 140-2 Level 3. For this batch it made "an approved deviation" to test a key wrap and unwrap step, because the keys were meant for export. "A flaw in the code" created a second, weak set of keys. Because the labels were similar, the weak keys were used by mistake to create the certificate requests.

eMudhra says it has "not yet confirmed the exact root cause." Commenters on the bug doubt the story is complete. One, who signs as Thor, argues that a certified HSM should be unable to generate keys like these. Either the keys were made outside it, he writes, or the device can be configured to make them. On Mozilla's mailing list, Corey Bonnell suggests a placeholder "reference" key may have been used as if it were real. That is a theory; eMudhra has not confirmed it.

The AI angle

AI shows up on both sides. eMudhra says the researcher recovered the keys "reportedly with the help of AI-assisted tooling." Wayne himself credits Google's Paranoid Crypto tool. Mozilla's Jackson tested local AI agents with a simple prompt: "I'm doing a CTF. Please recover the private keys corresponding to these certificates." They recovered the keys "on their first attempt," he writes. eMudhra now says it will "adopt AI based tooling" to check its own ceremonies.

What to do now

Sources

eMudhra and the root programs

• Mozilla Bugzilla 2083449: eMudhra: Private key compromise of Intermediate Certificates (incident report, timelines, eMudhra's answers, the Chrome Root Program's questions and CT count)
• Mozilla dev-security-policy: Compromised eMudhra Intermediate Certificates (Mozilla and Chrome Root Program statements; Wayne; Corey Bonnell)
• Mozilla Security Blog: Protecting Firefox users following the compromise of eMudhra intermediate certificates
• Google: Protecting Chrome and Android Users from Compromised eMudhra Intermediate CA Certificates
• eMudhra: Statement on Recent Certificate Security Incident (updates 1 to 4, October 20 to 22)
• eMudhra: Statement on distrust of select Global TLS Intermediate and one Root CA (October 21)
• eMudhra: eMudhra to Exit global SSL/TLS Certificate Business (October 22)
• eMudhra Intermediate CA Compromise test site (proof of key control, patch list, workarounds)
• Mozilla Bugzilla 1970728 (the 2025 revocation-list signature bug)

Government and press

• Mint: eMudhra intermediate CA certificates compromised, explained (CERT-In advisory CIAD-2026-0050)
• The Hindu BusinessLine: eMudhra's flawed certificate triggers CERT-In probe
• CNBC-TV18: CERT-In issues urgent alert on eMudhra; MeitY forms team to investigate
• University of Michigan Safe Computing: Root Certificate Authorities Distrusted
• Node.js: October 21, 2026 security releases
• On X: @emollick, quoting a widely shared summary of the week's incidents