{"id":2853,"date":"2026-10-22T08:33:25","date_gmt":"2026-10-22T08:33:25","guid":{"rendered":"https:\/\/newsraise.com\/in\/2026\/10\/22\/emudhra-weak-ca-keys-exposed\/"},"modified":"2026-10-22T08:33:25","modified_gmt":"2026-10-22T08:33:25","slug":"emudhra-weak-ca-keys-exposed","status":"publish","type":"post","link":"https:\/\/newsraise.com\/in\/2026\/10\/22\/emudhra-weak-ca-keys-exposed\/","title":{"rendered":"eMudhra\u2019s Weak CA Keys Exposed, Threatening Global HTTPS Trust"},"content":{"rendered":"\n<!-- Quick Adsense WordPress Plugin: http:\/\/quickadsense.com\/ -->\n<div class=\"9fece8afa224fd09e54b043d0febfb58\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js\"><\/script>\r\n<!-- NR ATF -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-8898941184964366\"\r\n     data-ad-slot=\"4839033563\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<p>Indian certificate authority eMudhra disclosed a critical security flaw that left eight of its intermediate certificates vulnerable to immediate key recovery. The weakness stems from private keys that were far smaller than industry standards, enabling an attacker to guess each key in under a second and potentially forge HTTPS certificates for any domain.<\/p>\n<h2>Discovery and public disclosure<\/h2>\n<p>The vulnerability was uncovered on October 17 by a security researcher known only as Wayne, who was conducting routine checks against the Common CA Database (CCADB). To demonstrate the severity of the issue, Wayne signed the phrase \u201cWe have a problem here \u2013 Wayne\u201d with each compromised key and forwarded the findings to major platform owners, including Apple, Google, Microsoft, Mozilla, and eMudhra itself.<\/p>\n<p>Mozilla\u2019s security lead Dennis Jackson made the incident public on October 20 via the organization\u2019s dev\u2011security\u2011policy forum. Jackson warned that the compromised keys could allow malicious actors to issue fraudulent HTTPS certificates for sites they do not control, as the intermediates chain to root certificates trusted by the four major browser vendors.<\/p>\n<h2>Technical details of the key weakness<\/h2>\n<p>According to Mozilla\u2019s incident report, the eight affected intermediate certificates were part of a batch of 24 generated on April 30, 2025. Six of the intermediates were intended for TLS website certificates and two for code\u2011signing. All eight were cross\u2011signed by the global CA Sectigo in May 2025.<\/p>\n<p>Standard practice requires a private key to be a random number exceeding 100 decimal digits, providing sufficient entropy to resist brute\u2011force attacks. In eMudhra\u2019s case, each key was less than 256 in value. This means an attacker needs to test at most 256 possible numbers to recover the key\u2014a task that can be completed in a fraction of a second on ordinary hardware.<\/p>\n<p>Security researcher Scott Helme confirmed the ease of recovery. He posted the exact values he uncovered, noting that one key was literally the number \u201c4\u201d, another \u201c56\u201d, and a third \u201c115\u201d. Helme emphasized that, unlike typical key compromises that involve theft, these keys were effectively public from the moment the certificates were issued.<\/p>\n<h2>Browser response and revocation timeline<\/h2>\n<p>Following the disclosure, major browsers acted swiftly. Chrome and Firefox blocked the eight intermediates on the day of the report. Apple removed trust on October 19, and Microsoft followed on October 20. eMudhra revoked the certificates on October 18, a day after the initial finding.<\/p>\n<p>Despite the rapid browser response, Jackson cautioned that the incident\u2019s impact could be severe for devices and applications lacking reliable revocation mechanisms. He highlighted the risk that such systems might continue to trust the compromised certificates, leaving user traffic exposed to interception or modification.<\/p>\n<p>After multiple independent recoveries of the keys, Mozilla removed trust in the eMudhra root certificate that signed the intermediates. Google announced a similar move for Chrome and indicated a \u201cthorough evaluation\u201d of any remaining eMudhra CA certificates. eMudhra has ceased issuing new certificates from the affected root and estimates that roughly 30,000 customer certificates will need to be replaced.<\/p>\n<h2>Root cause and remediation efforts<\/h2>\n<p>eMudhra traced the flaw to a faulty script used during the April 2025 key\u2011generation ceremony. The script inadvertently produced a second set of weak keys whose labels resembled those of the correctly generated keys. Staff, unaware of the duplication, selected the weak keys when preparing the certificates for issuance.<\/p>\n<p>The company asserted that only one of the eight intermediates ever entered production and that none were used to issue certificates to external customers. Nevertheless, eMudhra admitted to human errors at several stages of the process and pledged to audit every key ceremony it has performed to date.<\/p>\n<p>It remains unknown whether any party exploited the weak keys during the 17 months between their creation and public reporting. Security experts warn that applications, servers, or embedded devices that do not receive timely revocation updates could still trust the compromised certificates, potentially exposing sensitive data.<\/p>\n<h2>Industry reaction and recommendations<\/h2>\n<p>Cloudflare described the incident as \u201ca serious security incident with implications across the Internet.\u201d The company noted that the weak keys allowed attackers to forge certificates for any domain, enabling man\u2011in\u2011the\u2011middle attacks against traffic routed through Cloudflare\u2019s network.<\/p>\n<p>Helme recommended that administrators update the certificate trust stores used by their systems and urged users to ensure their browsers and operating systems are current. Mozilla\u2019s disclosure page also advises users to apply the latest updates to mitigate any lingering risk.<\/p>\n<p>The eMudhra episode underscores the importance of rigorous key\u2011generation procedures and robust verification steps in public\u2011key infrastructure. As digital certificates continue to underpin secure web communication, even a single misconfiguration can ripple across the global internet ecosystem, affecting browsers, cloud providers, and end\u2011users alike.<\/p>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Eight intermediate certificates issued by Indian CA eMudhra were signed with private keys so weak they could be guessed in under a second, prompting browsers to revoke trust and forcing replacement of tens of thousands of certificates.<\/p>\n","protected":false},"author":2,"featured_media":2854,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[299],"tags":[1960,3171,1411,3174,3172,3173],"class_list":["post-2853","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-browser-security","tag-certificate-authority","tag-cybersecurity","tag-digital-certificates","tag-emudhra","tag-tls","entry"],"_links":{"self":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/posts\/2853","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/comments?post=2853"}],"version-history":[{"count":0,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/posts\/2853\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/media\/2854"}],"wp:attachment":[{"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/media?parent=2853"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/categories?post=2853"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsraise.com\/in\/wp-json\/wp\/v2\/tags?post=2853"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}