Overview
- A researcher reported on Oct. 17 that eight intermediate certificate authority private keys generated by eMudhra were trivially small single‑byte values, allowing anyone to recover them from the public certificates in under a second.
- Chrome and Firefox blocked the affected intermediates within hours of the report and Apple and Microsoft followed with blocks; Mozilla removed the emSign ECC Root CA - G3 and Chrome plans to remove it from its store on Oct. 27.
- eMudhra revoked the eight intermediates and says the weak keys were produced by a faulty key‑generation / key‑wrap step during an April 30, 2025 ceremony and that only one intermediate was deployed in production, a claim under investigation.
- Ecosystem maintainers have issued emergency fixes (Go, NSS, certifi, webpki‑roots, Homebrew) but many non‑browser programs, older runtimes and IoT devices rely on static root bundles or do not check revocation and may continue to trust the compromised keys until they are updated.
- The incident shows how a single operational error can undo trust in the WebPKI: intermediates sign site certificates while roots anchor trust in stores, so removing a root or blocking keys can stop legitimate services and trigger wider remediation and regulatory scrutiny.