A Certificate Authority's Private Keys Were Smaller Than 256. It Just Quit the Business.

Here's the entire business model of a certificate authority in one sentence: it generates numbers so random that nobody on Earth can guess them, and then vouches that everyone else's numbers came from the same process. The randomness is the product.

So imagine what happens when one of the companies selling that product turns out to have generated keys of 4, 56, 66, 115, 155, 156, 230, and 237. Numbers a laptop can recover from the public certificates in under a second. A three-digit bike lock has more combinations.

That's what happened at eMudhra, a publicly listed Indian certificate authority. On October 22, its board voted to shut down the company's entire global SSL/TLS business. The stock had already fallen 36% in two trading sessions. The remarkable part isn't the failure — it's how fast the internet's immune system worked: a researcher reported the weak keys at 18:05 UTC on October 17, and by 19:45 Chrome had already blocked them worldwide, no browser update required.

What a certificate authority actually does

Your browser doesn't actually know who yourbank.com is. It trusts a chain. At the top sit roughly 150 root certificates baked into your operating system and browser — the "root store." Those roots delegate the daily work to intermediate CAs, which sign the actual certificates websites present to you.

Whoever holds an intermediate CA's private key can issue a certificate that browsers will accept for any domain. That's not a metaphor: with eMudhra's compromised keys, someone could have minted a certificate for your bank, your email provider, or your company's login page, and your browser would have shown the reassuring padlock. Two of the eight intermediates were also code-signing CAs — the kind whose keys let software installers claim "this came from a verified publisher." Same trick, different target: malware wearing a legitimate name tag.

The single most important object in the whole system is the private key, and a private key on the P-384 elliptic curve is supposed to be a randomly generated 384-bit number — roughly 10¹¹⁵ possibilities, more than the number of atoms in the observable universe. Guessing one should take longer than the universe will exist. eMudhra's keys were all smaller than 256.

A safety test introduced the flaw

The story starts on April 30, 2025, at a key-generation ceremony — the formal, audited event where a CA creates its most important keys on locked-down hardware with witnesses watching. eMudhra added an approved extra step that day: a test of how keys are wrapped and unwrapped.

A flaw in that step, by the company's own account, produced a second, weaker set of keys alongside the strong ones. Similar labels meant staff picked the wrong set for the certificate signing requests. The extra safety test is what broke the safety.

What should worry you more is what happened next. The weak keys survived two independent audit cycles. Audits verify that you followed a process — they don't sanity-check whether the output was a sane key. Nobody looked at the master key and noticed it was labeled "4." The company's co-founder later called it a "one-off human and script error... on a bad day," and admitted that an earlier mishap — a certificate revocation list error in May 2025 — should have triggered a closer investigation. It didn't.

The internet ejected it in 100 minutes

The system did work, though — just not at the CA. A researcher going by "Wayne" ran a check against the public CA database, realized the keys were recoverable, and reported them to Google's Chrome Root Program at 18:05 UTC on October 17, signing his message "We have a problem here – Wayne" with each of the eight keys to prove he held them. Mozilla independently recovered the keys within about two hours.

What followed was the trust system's emergency procedure executing at speed:

• 19:45 UTC, October 17 — 100 minutes after the report — Chrome pushed a CRLSet update blocking the six website-issuing intermediates. No user update or restart needed; every Chrome user was protected at once.
• 20:06–22:59 UTC — Mozilla pushed a OneCRL block to Firefox users with standard settings.
• October 18 — eMudhra revoked all eight intermediates for "CA compromise" (09:24–09:38 UTC).
• October 19 — Apple blocked the certificates; Sectigo revoked its cross-signatures.
• October 20 — Microsoft blocked them; Mozilla removed the emSign ECC Root CA – G3 from its trusted root list; Go shipped fixes on its rarely-used URGENT track.
• October 21 — India's CERT-In issued advisory CIAD-2026-0050: update browsers and operating systems, replace affected certificates.

Google's security teams noted the detail that matters in retrospect: the keys never had to be stolen. They were generated with too little randomness, so anyone could compute them from the public certificates. And because no certificates chaining to the weak intermediates had ever been logged to Certificate Transparency — the public ledger browsers require — no fraudulent certificate could have been silently trusted in Chrome or other CT-enforcing browsers. The exposure was real; the damage was contained.

Why quitting the business is the rational move

eMudhra's board concluded that "withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders." The business contributed about 1% of global revenue; the chairman cited rising compliance costs and free-certificate competition — then added that "the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS's place in our business."

He's not wrong about the economics, but the framing undersells what happened. For most certificate authorities, SSL/TLS is the entire business. eMudhra is quitting a business where its core competency — generating unguessable numbers — failed in public, in front of every browser vendor on Earth. Roughly 30,000 certificates need replacing, free through partners; its RSA roots keep serving customers during the transition; and an independent audit of its key inventories will be published. Its other businesses — digital signatures, eSign, enterprise PKI — run on separate infrastructure and are, per the company and India's IT ministry, completely unaffected. That separation is now the most valuable sentence in its press release.

What this means for you

If you run websites: check whether any of your certificates chain to eMudhra's emSign ECC Root CA – G3 or the G3B/G3C intermediates. If they do, replace them — free replacements are offered through partners, and Chrome's Root Store v43 (around October 27) will distrust the remaining root entirely. Browsers already did their part automatically; Go developers should be on the October 20 security release.

The eMudhra incident had no breach, no intruder, no stolen data. Nothing was "hacked." The failure was in the one process the entire certificate system is built on, and the two audits that certified it. Key generation is the least glamorous part of cryptography — and the only part that matters, because everything above it assumes the numbers were random.

And the part worth remembering the next time someone tells you a process is safe because it was audited: two auditors signed off on private keys smaller than 256. The check that caught it was one researcher with a laptop and less than a second of compute.

References

• Fortune India — "eMudhra Exits Global SSL/TLS Business After Security Incident; Shares Plunge 20%"
• The Hacker News — "Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software"
• Rescana — "eMudhra CA Key Compromise: Chrome and Firefox Have Blocked It"
• The Daily Pioneer — "eMudhra certificates carried keys anyone could guess, forcing a global cleanup"
• Cyberpress — "Critical eMudhra Certificate Authority Flaw Allows Forging Trusted HTTPS Certificates"
• Analytics India Magazine — "eMudhra to Exit Global SSL/TLS Certificate Business"
• News18 — Exclusive interview with eMudhra co-founder Kaushik Srinivasan
• Mathrubhumi — "Weak keys, fake websites, 20% crash: eMudhra's certificate blunder explained"