Every so often a security story comes along that makes me laugh out loud before I remember that the entire web runs on this stuff. This is one of those.
eMudhra is an Indian certificate authority. Its root sits in the trust stores of Firefox, Chrome, Safari and friends, which means any certificate it signs is, as far as your browser is concerned, gospel. Last week a researcher known as Wayne was scanning public certificate data and noticed something off about eight of eMudhra’s intermediate certificates. They all used P-384 elliptic curve keys, which is a perfectly respectable choice. A P-384 private key is supposed to be a random number somewhere in a space of roughly 2^384 possibilities.
These ones were smaller than 256.
Not 256 bits. The number 256. You could recover the private key by trying every value from 1 to 255, which a laptop does in less time than it takes you to read this sentence. Another researcher, Flüpke, published one of the recovered keys on GitHub. For the certificate named “EM OV TLS CA – G3C”, the private key was 4. BleepingComputer checked, and yes, it matches a revoked cert.
How do you even do that?
According to eMudhra, a script used to generate certificates back in April 2025 had a bug that produced a second batch of weak keys alongside the proper ones. The labels looked alike, someone picked the wrong set, and the resulting intermediates got signed. Some of them were even sent to Sectigo for cross-signing. Nobody noticed for eighteen months.
The company says most of these intermediates were never used in production and that it found no evidence they issued any certificates to actual customers. That’s probably true. It’s also beside the point. From April 2025 until October 17, 2026, anyone who had the same idea as Wayne could have minted a valid-looking certificate for literally any domain and intercepted TLS traffic, and nobody would have been the wiser. eMudhra has now revoked the lot and stopped issuing under its G3 root entirely.
The browsers moved fast, for once
Credit where it’s due. Mozilla pushed the block through OneCRL on October 17, the same day the problem surfaced, with no browser update or restart needed. Chrome blocked the six intermediates that could issue TLS certs that same day. Apple followed on October 19. Mozilla then shipped Firefox 158.0.1 and ESR updates on the 20th for setups where revocation updates had been disabled.
So if you only ever browse the web in a mainstream browser, you were covered within hours. Good.
The part that should actually worry you
Your browser isn’t the only thing that validates certificates. Your package manager does. Your CI runners do. That Python script with requests that talks to a payment API does. And a lot of that software ships its own trust bundle and never checks revocation at all. To them, the certificate with private key 4 is still perfectly fine.
Go had to release 1.27.3 and 1.26.10, tracked as CVE-2026-111943. Mozilla cryptography engineer Dennis Jackson put together a tracking page listing what’s affected, and it reads like a who’s who of the stack: several Linux distributions, NSS, curl, Node.js, Python’s certifi, assorted Rust crates, Electron. At the time BleepingComputer published, Debian, FreeBSD, Node.js and Bun were still marked as pending. Jackson also pointed out that the /usr/bin/curl that ships with macOS may keep trusting the bad intermediates, because its bundled certificate store doesn’t look at revocation info at all.
What I’d do, concretely: update everything that has a CA bundle, not just the browser. Run your distro updates, bump certifi in your Python environments, update Node and Go toolchains, and hit the test endpoints in the advisory from any machine or container that matters to see whether it still accepts the compromised certs. If it does, you’ve got a trust store to fix.
And if you’re the kind of person who runs a homelab with a dozen Docker containers each dragging its own copy of ca-certificates from 2023, well, this is your sign.
We’ve built a trillion-dollar trust system on the assumption that nobody would ever pick 4 as a secret. Somebody did.
Discover more from TechPassion
Subscribe to get the latest posts sent to your email.
