Eight certificate authority keys from Indian company eMudhra had private values so weak that anyone could recover them almost instantly. Security researcher “Wayne” discovered the flaw on October 17 and proved it by signing a message with each compromised key. Experts now warn the cleanup will take longer than the 2014 Heartbleed crisis.
The weakness was staggering. A normal P-384 elliptic curve private key contains roughly 384 bits of entropy, allowing nearly 2^384 possible values. The compromised keys ranged from just 3 to 8 bits. Their actual private key values were 4, 56, 66, 115, 155, 156, 230, and 237. Security researcher Scott Helme confirmed he recovered all eight keys from public certificates in under a second.
eMudhra is an Indian CA that sells certificates under the emSign brand through companies in India, the United States, and the Netherlands, and it has roots in the Mozilla, Chrome, and Apple root stores. The eight compromised certificates are:
- TLS, domain validated: EM DV TLS CA – G3B (eMudhra BV, Netherlands) and EM DV TLS CA – G3C (eMudhra Inc, United States)
- TLS, organization validated: EM OV TLS CA – G3B and EM OV TLS CA – G3C
- TLS, extended validation: EM EV TLS CA – G3B and EM EV TLS CA – G3C
- Code signing: EM OV CS CA – G3B and EM OV CS CA – G3C
eMudhra created all eight intermediate certificates during a single key ceremony on April 30, 2025. A flaw in the ceremony script produced a second, weaker set of keys on the hardware security module during a key-wrapping test. Operators then selected the weak keys for certificate signing requests because their labels resembled the properly generated ones. Sectigo cross-signed them about two weeks later. eMudhra has acknowledged multiple human errors and said its investigation continues.
A warning sign also appeared early. In May 2025, certificate revocation lists for the six TLS intermediates failed signature verification. Sectigo reported this to eMudhra. However, eMudhra re-signed the CRLs with the weak keys, which matched the certificates, and closed the incident as a process error. The keys then stayed trusted for roughly 16 more months.
Major browsers responded within hours of Wayne’s October 17 report. Chrome blocked the six TLS intermediates through CRLSets by 7:45 PM UTC. Mozilla pushed a block to Firefox through OneCRL by 10:59 PM that same evening. Apple followed on October 19, and Microsoft on October 20. However, as of October 21, Edge on Windows 10 was still connecting to 12 vulnerable hosts.
Valsorda warned the broader cleanup will dwarf past incidents.
“This will be a massive cleanup job, bigger than Heartbleed,” he told media. “There will be a very, very long tail — IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools.”
He noted that Go programs must rebuild from source to get the fix, since it lives in the standard library’s crypto/x509 package.
Beyond browsers, many systems remain exposed. The Go team shipped emergency fixes under its URGENT track (CVE-2026-111943). Python certifi, Rust webpki-roots, Electron, and Homebrew also released updates. However, Debian, FreeBSD, Node.js, and Bun patches were still pending as of October 20. Helme tested common tools and found that curl, Python, Node, Go, and Java all accepted a forged certificate for Stripe’s API before patches.
eMudhra revoked all eight certificates and stopped issuing under its G3 root. The company said most affected intermediates were never used in production. Chrome found no TLS certificates chaining to the six intermediates in Certificate Transparency logs. However, tools like curl, Python, and Go do not check CT logs, so a forgery targeting only those clients would leave no public record. Nobody can prove the keys went unused during the 16 months they were live.
Mozilla removed emSign ECC Root CA – G3 from its trust store entirely. Chrome plans to do the same in version 43 and is also reviewing eMudhra’s remaining CA certificate. eMudhra estimates about 30,000 certificates must now migrate from its G3 root to chains under its G1 root.
The most immediate threat affects VPN users, particularly in countries where governments might intercept traffic. Exploiting the compromised certificates requires an adversary-in-the-middle attack, where the attacker proxies encrypted traffic between two parties. Well-resourced state actors or anyone controlling a local network at a coffee shop or university could pull this off. Apps like Signal, WhatsApp, and WireGuard remain unaffected because they do not rely on TLS for confidentiality.
