Eight Weak Private Keys at Certificate Authority eMudhra Were Cracked, Prompting Emergency Browser Fixes
Eight private keys at eMudhra were compromised
Eight private keys held by eMudhra, an Indian certificate authority, were compromised. A certificate authority is a company that issues the digital certificates your browser checks to confirm a website is real. If someone cracks a certificate authority's private key, they could forge certificates and pretend to be trusted websites.
A researcher named Wayne reported the flaw on Oct. 17. To show the problem was real, Wayne used all eight compromised keys to digitally sign a warning message reading: "We have a problem here – Wayne."
Browser makers and software developers have released emergency fixes, and no attacks have been reported so far.
Key details from the reports
- eMudhra has issued more than 60 million certificates, according to The Register.
- Researcher Scott Helme said one of eMudhra's certificate authority private keys was the number 4, another was 56, and another was 115.
- Helme said he recovered all eight keys from public certificates in under a second, and that the keys have been exposed since April 2025.
- Helme's reading of a Mozilla bug ticket says eMudhra blamed a bug in its key-setup script.
- No crypto attacks have been reported.
Why the keys were easy to crack
Cyber Security News said on X that eMudhra used tiny integers like 4, 56, and 237 as private keys instead of strong 384-bit random numbers. A proper key is a huge random number that no one could guess.
Helme went further, writing that one eMudhra certificate authority private key was the number 4, another was 56, and another was 115.
How the keys got out is still unclear. Helme's reading of a Mozilla bug ticket says eMudhra blamed a bug in its key-setup script.
Emergency fixes from browser makers
Mozilla got the report on Oct. 17 after 8 p.m. UTC and had a block in place about three hours later. Chrome blocked the certificates the same day. Apple followed on Oct. 19 and Microsoft on Oct. 20. eMudhra has also revoked them.
Mozilla warned that network interceptors could use these fraudulent certificates to impersonate trusted sites, allowing them to read or alter a user's data.
Older software may still be at risk
The real worry lies outside the browser, according to Helme. Many programs never check whether a certificate has been revoked.
"So the fact that eMudhra and Sectigo have revoked these intermediates doesn't help them at all," Helme wrote.
He said his tests showed tools like curl, Python, Node, Go and Java accepted a forged certificate for Stripe's API. Fixes are out for Go, Python's certifi package and Rust's webpki-roots. Node.js was still pending when last checked.
Crypto users face limited risk, but outdated tools are a concern
Crypto users could also be affected, though mainly outside the browser. Exchange bots, trading scripts and wallet backends often run on Python, Node or Go, and a forged certificate for an exchange's API could in theory let an attacker on the same network read or alter a bot's traffic.
Mudit Gupta, chief technology officer at Polygon Labs, told CoinDesk the bigger concern is not crypto itself but outdated software. "This is not a crypto-specific issue," Gupta said. "It is a generic issue that can be exploited for man-in-the-middle attacks, particularly against users running older or unpatched software. Crypto users who keep their wallets, trading tools and devices updated face lower risk, but the broader software ecosystem remains a concern."
What is confirmed
- Eight private keys at eMudhra were compromised.
- A researcher named Wayne reported the flaw on Oct. 17.
- Mozilla, Chrome, Apple and Microsoft blocked the certificates between Oct. 17 and Oct. 20.
- eMudhra has revoked the certificates.
- No attacks have been reported.
- Fixes have been released for Go, Python's certifi package and Rust's webpki-roots.
What is still unclear
How the keys got out is still unclear. Helme's reading of a Mozilla bug ticket says eMudhra blamed a bug in its key-setup script, but this is a reported explanation, not a confirmed cause.
The claim about weak integers used as keys comes from researchers and Helme, and the exact details of the key setup have not been officially confirmed beyond the reported Mozilla ticket.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.