eMudhra's Eight Intermediate CA Keys Were Single Bytes, Recoverable in 256 Guesses

An unauthenticated attacker who knew the public certificates of eight eMudhra intermediate certificate authorities (CAs) could work out their private keys on a laptop, because each key was a single byte padded with zeros. Browsers have blocked all eight. Software that ships its own CA bundle and skips revocation checks has not necessarily caught up, and the fix there is to update the ca-certificates package or its equivalent.

What was recovered and when

A researcher identified only as Wayne reconstructed the keys and, on Saturday 17 October 2026, reported them to the root programs at Apple, Google, Microsoft and Mozilla, and to eMudhra. According to Dennis Jackson's disclosure site, Wayne signed the message "We have a problem here - Wayne" with each key as proof of control.

The timeline, from Scott Helme's write-up and Jackson's page:

• April 2025: eMudhra creates the eight intermediates; Sectigo's AAA Certificate Services root cross-signs them in May 2025.
• 17 October 2026: Chrome pushes a CRLSet update that evening; Mozilla blocks them in Firefox through OneCRL a few hours later.
• 19 October: Apple blocks the certificates.
• 20 October: Microsoft blocks them, and Mozilla announces the issue publicly and ships an NSS update removing the eMudhra root.

Helme's account of eMudhra's own explanation is that a bug in a key-generation ceremony script created a second, weak key pair on the hardware security module, and similar names led to the wrong keys being used for the certificate signing request. Inc42 dates that ceremony to 30 April 2025 and says eMudhra is still investigating the exact error.

Why 256 guesses was enough

The keys are on the P-384 curve. A sound P-384 private key is a random 384-bit number. Helme reports that these keys were 47 zero bytes followed by one byte, so there were at most 256 candidates, each checked against the certificate's public key in a fraction of a second. The keys are structurally valid, which is why nothing in the certificates looked wrong.

Intermediate	Purpose	Recovered d
EM DV TLS CA - G3B	TLS	156
EM DV TLS CA - G3C	TLS	230
EM EV TLS CA - G3B	TLS	115
EM EV TLS CA - G3C	TLS	56
EM OV TLS CA - G3B	TLS	155
EM OV TLS CA - G3C	TLS	4
EM OV CS CA - G3B	Code signing	66
EM OV CS CA - G3C	Code signing	237

The score question: how much exposure is there?

There is no CVE and no CVSS score, so the severity has to be argued from preconditions. Google says no certificates chaining to the six TLS intermediates appeared in Certificate Transparency logs, per Inc42. Chrome, Firefox and Safari require Certificate Transparency, so a forged certificate would not have been trusted by default in Chrome.

The gap is outside browsers. Helme tested default Linux and macOS installs and found that curl, Python and Node accepted a forged api.stripe.com certificate. On Windows, CryptoAPI accepted it unless revocation checking was switched on. Most non-browser clients trust the CA bundle on disk, do not check revocation by default and do not check Certificate Transparency.

The two code-signing intermediates are a separate exposure. India's CERT-In warned that compromised code-signing keys could let malicious software appear to come from a trusted publisher, per Inc42.

eMudhra's own account differs from the browser vendors' on scope. Inc42 reports the company says the incident was confined to eight intermediates, that root keys were not affected, and that none of the eight issued certificates to end users or websites. A second Inc42 piece says only one of the eight was deployed in production. Jackson's page says the intermediates could have been exploited from April 2025, since no Certificate Transparency entries exist for the period to rule it out.

What to do

Update browsers and operating systems, and the ca-certificates package on Linux. Jackson's page lists a "Who has patched?" table and platform workarounds, including a PowerShell script for Windows and manual steps for macOS, Linux, NetBSD and FreeBSD, to be used only where no patch exists.

Inc42 reports eMudhra shares hit their 20 percent lower circuit at ₹431.55 on the BSE on 21 October, and that its global TLS business is about 1 percent of revenue. Google's removal of the emSign ECC Root CA - G3 root from the Chrome Root Store reaches supported devices on 27 October. Other fixes this week: GitLab's second CVSS 10.0 overflow and Railway's decrypted variables.