
A trusted certificate authority shipped a private key equal to 4. Yes, the number four.
eMudhra signed eight intermediate certificates with P-384 keys so small you could brute-force them by counting to 256. Browsers pulled the plug within hours, but your curl might still trust them.
October 23, 2026









