One of the private keys used by an intermediate certificate authority of the Indian company eMudhra was simply the number 4. The flaw was part of a set of eight easily reproducible cryptographic keys, whose discovery led Google and Mozilla to block potentially dangerous certificates in Chrome and Firefox.
The problem was reported to the technology companies on October 17 and publicly disclosed on Tuesday (20). Security researcher Scott Helme confirmed the vulnerability by recovering all eight keys from public certificates in less than a second.
"One of eMudhra's certificate authority private keys is the number 4," wrote Helme, who also identified keys corresponding to the numbers 56, 115 and 156.
The affected authorities included six intermediate authorities intended for issuing TLS certificates, used in HTTPS connections, and two related to code signing. The exposure could allow the creation of fake certificates capable of impersonating legitimate services in applications that still trusted those authorities.
Why a valid cryptographic key could be discovered in milliseconds
The keys used P-384 elliptic curve cryptography, designed to work with private numbers of up to 384 bits. When generated correctly, they offer such a large space of possibilities that discovering the private key from the public key is considered computationally infeasible.
In eMudhra's case, however, all eight keys fit in just one byte, reducing the search to at most 255 possible values.
The problem was not in the cryptographic algorithm, but in the lack of randomness during key generation. The certificates remained mathematically valid and could pass conventional checks, despite offering virtually nonexistent protection against recovery of the private key.
The severity also varied depending on the software used. Google reported that no TLS certificate issued by the six intermediate authorities had been recorded in Certificate Transparency systems before the block. This prevented its use with clients that require this logging, such as Chrome in its default configuration.
Other applications do not necessarily offer the same protection. In local tests, Helme demonstrated that clients such as curl, Python and Node.js accepted a forged certificate with one of the compromised keys. The experiment confirmed the technical possibility of forgery, but did not demonstrate real attacks against users.
Chrome distributed the block on the affected keys through CRLSet on October 17. Firefox used OneCRL, completing distribution of the protection to users with default configurations that same evening. Neither of the two browsers required a manual update or restart to apply these measures.
Mozilla also made additional versions of Firefox available for installations with special configurations and began removing the root authority related to the incident from its NSS certificate library.
Google, in turn, announced the removal of the emSign ECC Root CA - G3 authority from its trust list, with distribution scheduled for October 27. The change requires website operators who use legitimate certificates linked to this root to replace them to avoid connection problems.
In an updated statement on Wednesday (21), eMudhra explained that a key processing step during a ceremony held in April 2025 produced a second set of weak keys, later used in issuing the intermediate certificates. The company said the procedure involved certified hardware security modules and that the exact cause is still under investigation.
The company stated that it had revoked the eight intermediate authorities on October 19. According to its analysis, seven were never used in production, while the remaining one did not actually issue certificates for users or sites. It also stated that it had found no evidence of exploitation before the disclosure.
Although the private keys of the root authorities were not compromised, the preventive removal of one of them from trust lists already requires the replacement of legitimate certificates. According to eMudhra, this operational impact is concentrated in a customer ecosystem in the United States, whose migration is underway.
