A Bengaluru company that the world’s major browsers trust to vouch for websites created the secret keys for eight of its certificates with a flaw so basic that anyone could have worked them out in seconds. Google, Mozilla, Apple and Microsoft have had to take emergency action to stop their software from trusting the certificates.
The company, eMudhra Ltd, should have generated each key as a number about 116 digits long, chosen at random. The keys it actually used were 4, 56, 66, 115, 155, 156, 230 and 237, numbers a computer can find in a fraction of a second by trying every value up to 255.
All eight were intermediate certificates, the kind a certificate authority uses to issue certificates to websites and software makers. With any one of six of the keys, anyone could have issued a certificate for any website in the world that browsers, phones and computers would have accepted as genuine. The other two could have been used to sign software so that Windows treated it as the work of a verified publisher.
“As this incident enables even technically unsophisticated individuals to easily recover the private keys for these intermediates, the impact of this incident could not be higher,” Mozilla, which makes the Firefox browser, wrote in its incident report.
The weak keys were eMudhra’s own doing. In its replies to Mozilla, the company said its staff used them by mistake at a key generation ceremony in April 2025, and that “there were human errors in multiple steps of the process”. It also missed a warning sign in May 2025, and the flaw went unnoticed for 18 months until a researcher identified only as Wayne reported it on October 17.
Mozilla blocked the certificates in Firefox within three hours, and Google, Apple and Microsoft followed within three days. On October 20, Mozilla announced the “emergency removal of trust” in one of eMudhra’s root certificates, the top-level certificates that browsers trust directly. Google said Chrome would follow a similar path, and eMudhra says about 30,000 of its customers’ certificates will now have to be reissued.
There is no public evidence that anyone used the keys, and the major browsers had a safeguard that would have exposed an attempt against their users. The risk lies in the much larger body of software that lacks that safeguard and does not get the browsers’ rapid updates: mobile apps, servers, payment terminals, routers and other connected devices. Those will go on trusting the compromised certificates until someone updates them. India’s national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), had not issued any new advisory since October 19 at the time of publishing.
“This isn’t just about eight compromised keys. It’s about the global internet’s chain of trust. A single authority’s failure can undermine authentication for organisations that have never dealt with it. The cleanup could be enormous, particularly for devices and software that cannot be easily updated,” said Yash Kadakia, founder & CTO, Security Brigade.
Browsers and operating systems trust several dozen certificate authorities, and any one of them can vouch for any website on earth. A mistake at one of them, in this case a company in Bengaluru, puts the users of every website at risk, including sites that have never been its customers.
Also read: Elon Musk says ‘people will find ways to be happy’ if AI makes money and work obsolete in future
How a website proves who it is
Every website whose address begins with “https” presents the visitor’s browser with a certificate, a small data file that works like an identity card. To take a hypothetical example, the certificate for sbi.co.in lets a browser confirm that the site it has reached is run by the State Bank of India. Once the browser is satisfied, it shows a padlock and encrypts what the user sends.
The browser accepts the certificate because a certificate authority, a company that checks who controls a website before vouching for it, has signed it. Mozilla, Google, Apple and Microsoft each keep a list of authorities their software trusts. eMudhra, which has held a licence from India’s Controller of Certifying Authorities since 2008, is on all four lists.
Trust passes down a chain. At the top are an authority’s root certificates, which browsers trust directly. The roots sign intermediate certificates, and the intermediates sign certificates for individual websites. If a website’s certificate is an identity card, an intermediate is the office that issues the cards, and whoever holds that office’s key can issue a card in any name that browsers will accept.
Each certificate is tied to a pair of mathematically linked keys. The private key is kept secret and does the signing, while the public key is printed in the certificate so that anyone can check the signatures. Working back from the public key to the private one is meant to be impossible, and the security of the whole chain depends on it.
Keys a computer could find in an instant
Under the encryption method eMudhra used, a private key should be drawn at random from a range of numbers far larger than the estimated number of atoms in the observable universe, which no computer can search. Written out at their full 116-digit length, eMudhra’s keys were zeros in every digit except the last three. Dennis Jackson, a cryptography engineer at Mozilla handling the incident, described them as “effectively all-zeroes apart from the last byte”.
Recovering them took nothing more than generating the first 256 possible keys and checking which matched the public keys printed in the certificates. Jackson wrote that AI agents he tested recovered the keys “on their first attempt with a simplistic prompt”, in which he told them he was taking part in a capture-the-flag hacking contest.
A mix-up at the ceremony
Certificate authorities create their most important keys at key generation ceremonies, scripted procedures carried out on tamper-resistant machines built to generate keys and guard them. eMudhra held the ceremony for these keys on April 30, 2025.
In its replies to Mozilla’s questions, which it described as a preliminary assessment, eMudhra said the keys were meant for export to its data centres in the United States and Europe “to solve data sovereignty issues for some of our customers”. Its staff departed from the usual script to test that export, in what the company called “an approved deviation”, and “a flaw in the code” produced a second set of keys that were weaker than the first.
eMudhra said that because “the key labels were similar”, staff used the weak set by mistake when preparing the certificates, which the company’s root then signed. The weak keys were also sent to Sectigo, another certificate authority, which vouched for the certificates as well.
Also read: Mozilla says Microsoft still steers Windows users towards Edge, except in the EU
The warning eMudhra missed
Certificate authorities regularly publish revocation lists, signed files naming certificates that should no longer be trusted. In May 2025, a month after the ceremony, the lists eMudhra published for six of these intermediates began failing signature checks. The fault was logged in a public Mozilla bug report at the time and closed as fixed.
Asked this week how it had fixed that problem, eMudhra wrote: “The CRL’s were signed with the original private keys (which were supposed to be the correct keys with appropriate entropy) but given that this resulted in incorrect signatures, they were resigned with flawed keys.”
In other words, eMudhra’s systems had shown that the strong keys it held did not match the certificates it had issued, and the company cleared the failures by signing with the weak keys that did match. Mozilla said it “seems unlikely that the exact same intermediate set has arisen in two different bugs by chance”. The certificates stayed trusted for another 17 months.
eMudhra’s public statement on October 20 said “none of the affected intermediate CAs were deployed in production, with the exception of one”, and that none had issued certificates to customers. The statement did not say that the keys were weak, that staff had used the wrong ones, or that the May 2025 failures had happened. The company acknowledged all three in its replies to Mozilla.
Also read: The keys to your accounts: How personal AI agents like Meta’s Muse work, and what they ask of users
Who could have been exposed
To use a forged certificate, an attacker has to intercept a victim’s connection, decrypting the traffic and passing it on so that neither side notices. Governments and internet providers can do this, and so can anyone who controls a Wi-Fi network at a café, hotel, office or university.
The major browsers were protected by Certificate Transparency, a system of public logs recording the certificates that authorities issue for websites. Chrome, Safari, Firefox and Edge accept a website certificate only if it appears in those logs, so a forgery aimed at their users would have been exposed to anyone watching. The advisory published with the disclosure says no certificate from the eight intermediates appeared there.
Mobile apps, payment terminals, routers, smart devices and servers that exchange data with each other mostly do not check those logs, and many ignore revocation lists as well. “We do not know if attackers exploited the flawed key generation to target these clients,” the advisory said. Ars Technica reported that the most immediate risk was to people using VPNs, services that encrypt and reroute a user’s connection, in countries whose governments are likely to intercept traffic.
Ars also found Microsoft’s Edge browser on Windows 10 still accepting the compromised certificates this week, after the advisory had recorded Microsoft’s block.
Found in under half-an-hour
Wayne’s timeline of the discovery, posted to the incident thread, begins at 9.30pm IST on Saturday, October 17, with the line “Started playing with some new toys”. Twenty-seven minutes later, a check of public records on certificate authorities flagged the broken keys. After checking the result several times, Wayne signed the message “We have a problem here – Wayne” with each of the eight private keys, which proved Wayne held them, and at 11.35pm IST emailed it to eMudhra, Apple, Google, Microsoft and Mozilla.
Mozilla’s engineers recovered the keys on their own within two hours, without knowing Wayne’s method, and by October 20 Mozilla said “multiple individuals have independently recovered the private keys”.
Also read: Xi’s open-source AI pitch: A reminder of why Delhi endorses a third way forward
What it means for India
eMudhra is one of the certifying authorities licensed under India’s Information Technology Act, and individuals and companies use its digital signature certificates to sign tax returns, company filings and government tenders. Those signatures run on a separate hierarchy of certificates overseen by the Controller of Certifying Authorities, and the incident reports give no indication that they are affected.
eMudhra told Mozilla that a set of website certificates “meant for deployment only in India” was generated on different machines, and Mozilla said it could not recover those keys “despite expending considerably more effort”. The company said it had confirmed its other certificates were sound using checks “corroborated primarily using mathematical models facilitated by AI”, and that it would “reverify every key ceremony we have done” over the next week.
