eMudhra's Eight CA Keys Were Numbers Below 256, and Chrome Drops Its G3 Root Oct. 27

The private keys behind eight eMudhra intermediate certificate authorities (CAs) were numbers no larger than 255, which let security researcher Scott Helme recover every one of them in under a second, he wrote on Oct. 20. Chrome, Firefox, Apple and Microsoft have blocked the eight, and Chrome removes the root that signed them on Oct. 27.

An intermediate CA is a certificate that a browser trusts because a root vouches for it; whoever holds its private key can mint HTTPS certificates for any domain. The affected keys are P-384 elliptic-curve keys, which should be random numbers of about 384 bits. According to Helme's analysis, these were zero-padded with only the final byte set, so the whole search space is 255 values.

1. EM OV TLS CA - G3C4
2. EM EV TLS CA - G3C56
3. EM OV CS CA - G3B66
4. EM EV TLS CA - G3B115
5. EM OV TLS CA - G3B155
6. EM DV TLS CA - G3B156
7. EM DV TLS CA - G3C230
8. EM OV CS CA - G3C237

Source: Scott Helme, 'Eight bits of trust', Oct. 20, 2026

What an attacker could do with 255 guesses

Six of the eight intermediates issue TLS certificates and two sign code. Helme issued a local certificate for api.stripe.com under the EM DV TLS CA - G3B intermediate. With default settings, curl on Linux and macOS reported SSL certificate verify ok, Python completed the handshake and Node reported authorized: true. Windows CryptoAPI accepted the chain unless revocation checking was on, and even then only one of two revocation routes flagged it.

Browsers were spared by a separate control. Google's security team said no TLS certificate chaining to the affected intermediates was logged to Certificate Transparency, the public record of issued certificates, before Chrome blocked them. Chrome and Android apps that enforce that logging would have rejected a forged certificate.

The intermediates were created on April 30, 2025 and cross-signed by Sectigo's AAA Certificate Services root in May 2025, Helme wrote. That is an exposure window of about 17 months, and he said there is no way to know whether anyone used it. eMudhra said it is "not aware of any evidence that the weak keys were recovered or exploited".

The first six hours, in UTC

Time	Event	Reported by
Oct. 17, 18:05	Chrome Root Program receives researcher's report	Google
Oct. 17, 19:45	Chrome pushes CRLSet block on the eight keys	Google
Oct. 17, 20:06	Report reaches Mozilla's certificates mailbox	CSO Online
Oct. 17, 22:59	Firefox OneCRL block fully distributed	Mozilla
Oct. 18	eMudhra revokes all eight intermediates	eMudhra

Chrome blocked 100 minutes after Google received the report. Mozilla's own post puts its block under three hours after its report. ThePrint, citing the researcher's timeline, said Apple and Microsoft followed on Oct. 19 and 20; neither company's own notice is cited here.

What eMudhra says went wrong

The Bengaluru-based certificate authority published a statement on Oct. 21 saying a flaw in one step of its April 2025 key ceremony, the wrap and unwrap of keys for transfer between hardware security modules, produced a second, weaker set of keys beside the strong ones. Similar key names then led a person to use the wrong set, according to eMudhra's account on the Mozilla ticket as relayed by Helme. The company said the root cause is not yet confirmed and the flaw passed two audit cycles over roughly 18 months.

eMudhra also said seven of the eight intermediates were never deployed and the one in production issued no certificates, so the exposure it describes is one US customer ecosystem. ThePrint reported that the company told SEBI, India's securities regulator, the affected business is about 1 percent of revenue, and that eMudhra shares fell 20 percent to Rs 432 on Wednesday. It also reported that eMudhra calls the matter a distrust while Mozilla classifies it as a private key compromise.

What operators have to do before Oct. 27

Google said Chrome removes emSign ECC Root CA - G3 from its root store on Tuesday, Oct. 27, and that site operators with certificates chaining to it must install a new certificate from another hierarchy before then. ThePrint put the number of customer certificates under that root at about 30,000, a figure from one outlet that the vendor posts do not repeat.

Firefox users on standard settings need no action. Those whose settings blocked the OneCRL update should install Firefox 158.0.1, ESR 115.43.1 or ESR 153.5.1, Mozilla said, and Mozilla's NSS 3.131.1 drops the root for other programs that share its trust store. Anything with its own trust list, including Linux servers and tools like the ones Helme tested, needs a manual update. India's CERT-In advisory, published Oct. 21, tells administrators to refresh trusted-certificate lists and replace linked certificates.

One upstream defect with a long downstream patch list is the pattern The Terminal traced in the Brotli flaw that reached PyPI, Envoy and Bun, and it makes the gap between a browser block and a server fix the real exposure here. A different trust failure is in Railway's disclosure that an attacker decrypted environment variables for up to 1.85 percent of workspaces.

Google's Chrome Root Program is still reviewing eMudhra's remaining root, and eMudhra has not yet published its full root cause. Chrome's removal of the G3 root lands on Oct. 27.