eMudhra's certificate authority keys turn out to be single-byte numbers, and it quits the global TLS business
One of the keys trusted by every major browser was the number 4. Scott Helme explains why that cannot be fully contained.
A researcher proved that the private keys of eight eMudhra intermediate certificate authorities, chaining to roots trusted by Mozilla, Microsoft, Apple and Chrome, were compromised, and reported it on October 17. The disclosure site says the keys were incorrectly generated and anyone could recover them from the certificates since April 2025. Security researcher Scott Helme says each key was a single byte (one was literally 4) and he recovered all eight in under a second. Browsers blocked the intermediates within days, and because no certificates from them appeared in Certificate Transparency logs, CT-enforcing browsers were protected, but curl, Python, Go, CI pipelines and embedded devices that don't check revocation or CT need updated CA bundles.
On October 22 eMudhra said it will exit the global SSL/TLS business, about 1% of its revenue, saying it revoked the CAs within 14 hours, no end-entity certificates were issued from them, and scrutiny was out of proportion.
Three Hacker News threads questioned how a CA passed audits with such keys, debated whether the web's CA system needs replacing, and criticized eMudhra's statement.
-
Certificate Transparency
After exploring Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds, to see why browsers were shielded and other software was not, read about Certificate Transparency.
An internet security standard for monitoring and auditing the issuance of digital certificates, so mis-issued certificates can be spotted.
Wikipedia · Wade · 5 min
0 -
How It Works
After exploring eMudhra Intermediate CA Compromise, for how certificates are normally issued, read How It Works.
Let's Encrypt walks through how a web server proves to a certificate authority that it controls a domain and then requests or revokes certificates, using the ACME protocol.
Let's Encrypt · Swim · 30 min
0