# eMudhra Certification Authority Compromised by Weak Private Keys Indian CA faces massive trust crisis after researchers discover trivial private key vulnerabilities. - **Source:** [www.theregister.com - Articles](https://brifing.si/source/2c34ea50-d341-4a10-925d-12c012a9ad10) - **Published:** 2026-10-20 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/6e316505-2169-48d7-8bbd-f17ba5305a21 ## Massive Digital Trust Breach The Indian certification authority eMudhra has suffered a severe security compromise affecting over 60 million issued digital certificates. Mozilla’s cryptography team received reports on October 17 regarding eight compromised intermediate certificates. This failure undermines the foundational trust required for HTTPS connections, potentially allowing attackers to impersonate servers and intercept sensitive user traffic. ## Trivial Private Key Vulnerabilities Security researcher Scott Helme discovered that eMudhra’s private keys were shockingly weak, with some consisting of simple integers like 4, 56, or 115. A standard P-384 private key requires a random 384-bit number, providing 2³⁸⁴ possibilities. Using such predictable values makes these certificates trivial to brute force, rendering the entire security infrastructure completely ineffective. ## Rapid Browser-Level Remediation Following the disclosure, major browser vendors including Mozilla, Chrome, and Apple moved quickly to remediate the issue. These companies updated their software to ensure browsers no longer trust the compromised eMudhra certificates. Users must install these latest browser updates to protect their systems from potential man-in-the-middle attacks targeting these specific, insecure digital credentials. ## Revocation and Ecosystem Impact eMudhra has officially revoked the affected certificates to mitigate further damage. Numerous FOSS projects have also released updates to stop recognizing eMudhra’s compromised signatures. Despite these efforts, many services still rely on these certificates, creating a fragmented security landscape where legacy systems remain exposed to potential traffic interception and server impersonation risks. ## Identifying Hidden Dependencies Organizations must now audit their internal environments to determine if they rely on certificates signed by eMudhra. Because browser makers only protect the end-user layer, backend services and non-browser applications may remain vulnerable. Developers like Geoffrey Huntley have provided guidance on automating the discovery process to identify and replace these insecure, legacy certificate dependencies. ## Lack of Corporate Transparency Despite the severity of the incident and widespread public scrutiny, eMudhra has not responded to inquiries regarding its security practices or the specific circumstances of the compromise. The absence of a formal statement leaves stakeholders questioning the internal protocols that allowed such rudimentary cryptographic errors to persist within a major certification authority. ## Cryptographic Standards Failure The incident highlights a catastrophic failure in implementing standard cryptographic practices. By using extremely small integers as private keys, the authority bypassed the mathematical complexity required for secure encryption. This case serves as a stark reminder that even large-scale certificate issuers can fail to maintain basic security hygiene, leading to global infrastructure risks. ## Long-term Security Implications This breach necessitates a massive clean-up operation across the global web. As the industry moves to purge these compromised certificates, the focus shifts toward stricter oversight of certification authorities. Future security audits will likely prioritize the verification of key generation processes to ensure that such trivial, easily guessable cryptographic failures never occur again. ## Sources covering this story - https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._