eMudhra Published a Certificate Key That Was Just 4

Eight eMudhra intermediate certificate keys were integers below 256, and one of them was 4. A researcher recovered all eight from public certificates on October 17, 2026, then proved control by signing a short message with each key.

Bengaluru-based eMudhra Ltd is a publicly trusted certificate authority. Those eight keys could mint a website certificate for any domain, and they had been sitting in browser trust lists since mid-2025.

The Private Key That Was Just 4

The keys were P-384 elliptic-curve values, the kind that should be a random 384-bit number. CERT-In’s advisory said the keys had values smaller than 256 and could be recovered almost instantly from the matching public keys. Six of the eight intermediates issue TLS certificates for websites. Two issue code-signing certificates.

Security researcher Scott Helme pulled the public certificates and brute-forced them on a laptop. Each private number fitted in a single byte, so the search was at most 255 steps. He published a private key that was 4 as a PEM block, then listed the rest.

One of eMudhra’s certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4… Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second.

Scott Helme, security researcher

Mozilla’s own engineers recovered the same keys in about two hours, without being told Helme’s method. A public key derived from 4 is a valid point on the curve, so ordinary certificate checks pass. The only way to catch it is to try the small numbers.

THE EIGHT INTERMEDIATE KEYS

Sectigo had cross-signed all eight under its AAA Certificate Services root in May 2025, so each weak key existed in two certificates. That made 16 public files pointing at the same eight numbers.

A Ceremony Script Picked the Wrong Key

eMudhra says the eight intermediates were created on April 30, 2025, in a key generation ceremony on FIPS 140-2 Level 3 hardware security modules. The company says the modules were used, and that the failure was in one step of the ceremony, not a missing box of hardware.

Staff had changed the usual script to test wrapping and unwrapping keys, because the intermediates were meant to move to data centres in the United States and Europe. That change produced a second, weak set of keys beside the strong ones. The labels looked alike, and the weak set went into the certificate signing requests that the company’s ECC root then signed. Those were the keys published to browser root stores.

eMudhra says it has not yet confirmed the exact root cause and will publish it when the inquiry finishes. It also says its own systems were not broken into, no data was stolen, and the Indian digital signature and eSign businesses run on separate systems. CERT-In repeated that split: the CCA-regulated signature business is not in this incident. The company says it has issued more than 60 million digital certificates in total, and that this failure sits in its global TLS line.

On its incident page, eMudhra said it moved to contain the affected certificates and work with browser and root-store operators. Seven of the eight intermediates were never used in production. The one that was in production had not issued a single end-entity certificate, a claim the company says matches Certificate Transparency records. The live damage, it says, is the later distrust of the ECC root, which hits one customer ecosystem in the United States. Replacement certificates are being issued from another trusted hierarchy.

Under 3 Hours to a Firefox Block

The researcher, known as Wayne, reported the keys to Apple, Google, Microsoft, Mozilla and eMudhra on October 17. As proof he signed the words “We have a problem here” with each key. Chrome’s root program received the report at 18:05 UTC and, at 19:45 UTC, finished a CRLSet update that blocked the public keys in Chrome for the six TLS intermediates, covering the Sectigo copies as well. Mozilla received the report at 20:06 UTC and, by 22:59 UTC, had blocked the certificates in Firefox through OneCRL, which does not need a restart for standard settings.

HOW THE BLOCK LANDED

1. April 30, 2025: eMudhra creates the eight intermediates in a key generation ceremony.
2. May 2025: Sectigo cross-signs all eight under AAA Certificate Services.
3. October 17, 2026, 18:05 UTC: Chrome receives Wayne’s report; at 19:45 UTC a CRLSet block is live.
4. October 17, 2026, 22:59 UTC: Mozilla finishes the OneCRL push, less than 3 hours after it got the report.
5. October 18, 2026: eMudhra revokes the eight intermediates.
6. October 19, 2026: Apple blocks them; Sectigo revokes the cross-signed copies.
7. October 20, 2026: Microsoft blocks them; Mozilla’s NSS 3.131.1 removes emSign ECC Root CA – G3.
8. October 21, 2026: CERT-In issues advisory CIAD-2026-0050; Mozilla ships Firefox 158.0.2 for Android after some phones skip the bundled blocklist at startup.

Firefox 158.0.1, plus ESR 115.43.1 and ESR 153.5.1, covers users whose custom settings blocked the OneCRL update. Chrome is set to drop emSign ECC Root CA – G3 from Chrome Root Store version 43 on October 27, which will also protect apps that never see intermediate revocation lists. Google said no TLS certificates chaining to the six weak intermediates appeared in Certificate Transparency logs before the October 17 block, so default Chrome users should not have trusted a forged site from those CAs. CERT-In said public disclosures as of October 21 had not established confirmed malicious use.

What Still Accepts a Forged Certificate?

Updated Chrome, Firefox and Safari users are in a different position from almost everything else that speaks TLS. Those browsers now reject the intermediates, and they require Certificate Transparency. curl, Python, Node, Go, Java, git, package managers, CI runners and most daemons do not. They trust a bundle on disk, they skip revocation by default, and they do not check CT. Revocation by eMudhra and Sectigo does not help them.

Helme minted a certificate for api.stripe.com with one of the recovered keys and pointed curl at a local server. With default settings, curl printed “SSL certificate verify ok”, Python finished the handshake, and Node reported the chain as authorised, on every Linux and macOS machine he tried. Windows CryptoAPI accepted the chain unless revocation checking was turned on, and even then only one of two paths came back revoked. Anyone on the network path could put another hostname in that certificate and intercept the traffic.

WHERE A FORGED CERTIFICATE STILL WORKS

• Installers and updaters: Tools that fetch a script or binary over HTTPS with no extra signature check will run whatever a forged certificate delivers, often as root.
• Build pipelines: GitHub and GitLab runners, Jenkins boxes and stale container images speak curl, Python, Go and Node, and they hold cloud keys.
• Server-to-server calls: Payment webhooks, OAuth token exchanges and cloud SDKs carry secrets in headers and often use their own CA bundle.
• Code signing on Windows: Malware signed with EM OV CS CA – G3B or G3C can look like a real publisher’s software to anything that skips revocation.
• Gadgets that never patch: Cameras, routers, cars, medical devices and controllers keep a frozen trust list until the certificates expire in July 2039.

Yash Kadakia, founder of the Security Brigade firm, said the cleanup could be enormous for devices and software that cannot be easily updated. Linux distributions and the Go project began shipping trust-store fixes after the report. By October 22, maintainers of Go-based Lightning software and the OkHttp library were telling operators to move to patched builds. Browser users still do not need to do anything beyond keeping the browser current.

Two Audits Missed a One-Byte Key

eMudhra says the hierarchy passed two independent audit cycles and had been in browser trust lists since mid-2025. The weak keys were public the day the certificates existed. Anyone who looked at them at any point in those 17 months could have recovered the numbers in milliseconds. There is no thief and no single moment of theft to bound who now has the keys.

Wayne found the flaw while checking the Common CA Database, which is the industry’s own public inventory. The keys were not hiding. A one-byte private scalar is a process failure that maker-checker rules and a simple “is this key smaller than 256?” test would have stopped. CERT-In told certificate authorities to verify generated key parameters, key identifiers and CSR mappings as part of key generation, which is a polite way of saying the output was never checked.

The last time guessable keys poisoned a large trust set, Debian’s OpenSSL package in 2008 had a broken random number generator, and “valid” certificates could be recovered the same way. When a certificate authority itself is the problem, the industry’s memory is DigiNotar in 2011. Attackers issued 531 rogue certificates, including one for Google, used against about 300,000 Gmail accounts in Iran. Browsers removed the Dutch CA from their stores, and the company was bankrupt by September 2011. eMudhra’s case is incompetence rather than an intrusion, but the trust model does not grade the difference. A CA that can ship the integer 4 as a signing key has already spent the asset it sells.

₹431.55 on the BSE Lower Circuit

eMudhra told the exchanges the affected global TLS business is about 1% of revenue, that Indian DSC and eSign services are running, and that it is replacing certificates for the one US customer group. On October 21 the stock was still locked at the 20% lower circuit at ₹431.55 on the BSE. A certificate authority does not sell a 1% product line. It sells the claim that its keys cannot be guessed.

Mozilla’s removal of emSign ECC Root CA – G3, and Chrome’s planned drop of the same root, force a migration eMudhra has estimated at about 30,000 certificates onto other chains. The Ministry of Electronics and Information Technology said it had taken serious note of the incident and formed a special team to look into it, while repeating that CCA-regulated signature services were not hit. Congress leader Pawan Khera called for a probe. The political noise does not change the technical file: the intermediates are revoked, the G3 root is being pulled, and the reputational bill is the one the market already posted.

Routers, Cameras and the 2039 Expiry

Website owners whose certificates chain to emSign ECC Root CA – G3 need replacements before clients that ingest Mozilla’s or Chrome’s store start rejecting them. eMudhra says it has stopped issuing under that root and is offering enterprise TLS customers a second publicly trusted CA so one hierarchy cannot take them offline. Administrators still have to install the new chain. Applications that pin or bundle their own CA list need a rebuild, not a browser restart.

The long tail is the kit that will never see that rebuild. Helme’s point about firmware frozen until July 2039 is the part browsers cannot patch for you. An attacker who can sit on the network path to those devices can still present a trusted-looking certificate for an update server or an API, unless the device is isolated or its trust list is replaced by hand. That is a fleet problem, not a homepage problem.

eMudhra has said it will review every step of its key ceremonies and that it takes full responsibility. The researcher who opened the file did it with a public database and a loop from 1 to 255. The keys were 4, 56, 66, 115, 155, 156, 230 and 237, and they were in the clear for 17 months.

Disclaimer: This article is news reporting and analysis of a certificate-authority incident and related market moves. It is for information only and is not investment advice, legal advice, or a security assessment of any network, website or device. Readers who hold eMudhra shares or operate systems that trust emSign or related certificate bundles should consult a licensed financial adviser and a qualified security or systems professional before acting. Figures, product versions, trust-store status and investigation details reflect the company, CERT-In, Mozilla, Google and researcher materials cited here and can change as patches and inquiries continue.