Severe Flaw Exposes Eight Certificate Authority Keys From eMudhra

A security researcher discovered eight weak certificate authority keys from Indian firm eMudhra that could be recovered almost instantly.

NationPulse Desk

Oct 21, 2026 · 1:00 PM 4 min read

Key takeaways

Security researcher Wayne discovered eight weak certificate authority keys from Indian company eMudhra on October 17.

Scott Helme confirmed he recovered all eight compromised private keys from public certificates in under a second.

eMudhra created all eight intermediate certificates during a key ceremony on April 30, 2025.

Major browsers such as Chrome, Mozilla, Apple, and Microsoft rolled out blocks within hours of the October 17 report.

eMudhra revoked all eight certificates and stopped issuing under its G3 root, forcing the migration of about 30,000 certificates.

On October 17, security researcher "Wayne" found that eight certificate authority keys belonging to Indian company eMudhra had private values so weak that anyone could recover them almost instantly, prompting expert warnings that the remediation will exceed the 2014 Heartbleed crisis.

A normal P-384 elliptic curve private key features about 384 bits of entropy, which permits nearly 2^384 possible values, but the compromised keys measured between 3 and 8 bits. Their actual private key values stood at 4, 56, 66, 115, 155, 156, 230, and 237, and security researcher Scott Helme verified he recovered all eight from public certificates in under a second.

eMudhra is an Indian CA selling certificates under the emSign brand via companies in the United States, Netherlands, and India, with roots in Apple, Chrome, and Mozilla root stores. The eight compromised certificates include:

TLS, domain validated: EM DV TLS CA - G3B (eMudhra BV, Netherlands) and EM DV TLS CA - G3C (eMudhra Inc, United States)
TLS, organization validated: EM OV TLS CA - G3B and EM OV TLS CA - G3C
TLS, extended validation: EM EV TLS CA - G3B and EM EV TLS CA - G3C
Code signing: EM OV CS CA - G3B and EM OV CS CA - G3C

During a single key ceremony on April 30, 2025, eMudhra generated all eight intermediate certificates. A ceremony script error created a second, weaker set of keys on the hardware security module during a key-wrapping test, and operators then picked the weak keys for certificate signing requests because their labels resembled proper ones before Sectigo cross-signed them about two weeks later, with eMudhra acknowledging human errors and ongoing investigations.

An early warning arrived in May 2025 when certificate revocation lists for the six TLS intermediates failed signature verification and Sectigo alerted eMudhra. eMudhra re-signed the CRLs with the weak matching keys and closed the matter as a process error, leaving the keys trusted for roughly 16 more months.

Hours after Wayne reported the issue on October 17, major browsers reacted. Chrome blocked the six TLS intermediates via CRLSets by 7:45 PM UTC, Mozilla deployed a Firefox block through OneCRL by 10:59 PM that same night, Apple followed on October 19, and Microsoft on October 20, though Edge on Windows 10 still connected to 12 vulnerable hosts as of October 21.

Valsorda cautioned that the broader cleanup will dwarf previous incidents.

"This will be a massive cleanup job, bigger than Heartbleed," he told media. "There will be a very, very long tail, IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools."

He mentioned that Go programs must rebuild from source to obtain the fix located in the standard library crypto/x509 package.

Beyond browsers, numerous systems remain exposed as the Go team shipped emergency fixes under CVE-2026-111943, and Rust webpki-roots, Python certifi, Homebrew, and Electron released updates, while Debian, FreeBSD, Node.js, and Bun patches remained pending as of October 20. Helme tested standard tools and discovered curl, Python, Node, Go, and Java accepted a forged certificate for Stripe's API prior to patches.

eMudhra revoked all eight certificates and halted issuance under its G3 root, stating most affected intermediates saw no production use. Chrome found no TLS certificates chaining to the six intermediates in Certificate Transparency logs, but tools such as curl, Python, and Go omit CT log checks, meaning a forgery targeting those clients leaves no public record and nobody can prove the keys went unused during their 16 active months.

Mozilla completely removed emSign ECC Root CA - G3 from its trust store, and Chrome plans the same in version 43 while reviewing eMudhra's remaining CA certificate, as eMudhra estimates about 30,000 certificates must migrate from its G3 root to G1 root chains.

The most pressing threat impacts VPN users, particularly in nations where governments might intercept traffic, as exploiting the compromised certificates demands an adversary-in-the-middle attack proxying encrypted traffic between two parties. Well-resourced state actors or anyone controlling a local network at a university or coffee shop could execute this, while apps like Signal, WhatsApp, and WireGuard stay unaffected since they do not rely on TLS for confidentiality.

Questions and answers