RESOURCE
Huit certificats intermédiaires émis par l'autorité de certification indienne eMudhra, rattachés à des racines reconnues par Apple, Google, Microsoft et Mozilla, ont été générés avec des clés privées si petites que n'importe qui pouvait les retrouver à partir du certificat public en moins d'une seconde. Les certificats ont été révoqués le 18 octobre, bloqués par les navigateurs les 19 et 20 octobre, Mozilla a retiré la racine et eMudhra a annoncé qu'elle quittait le marché du TLS public.
Fabric Networks
Start with a conversation about your cryptographic posture.
A security researcher checking the Common CA Database on October 17, 2026 found that eight eMudhra intermediate certificates carried private keys smaller than 256, where a proper key is a random number more than 100 digits long. With a key that small, an attacker can recover it by trying at most 256 values and then forge a valid HTTPS certificate for any domain. Six of the intermediates could issue TLS certificates and two were for code signing; all eight were cross signed by Sectigo in May 2025. eMudhra attributes the fault to a script used in an April 2025 key ceremony that produced a second, weaker set of keys with similar labels.
eMudhra revoked the certificates on October 18, Apple blocked them on October 19, Chrome and Firefox on the day of the report, Microsoft on October 20, and Mozilla removed trust in the signing root. Cloudflare, which published its own incident report on October 20, patched its clients and services before disclosure, reported no exploitation on its network, and told customers to update trust stores, review uploaded client CAs and origin certificates, and above all not to clear errors by disabling verification. Nobody can say whether the keys were used during the seventeen months they were in the wild.
Nothing was stolen here. The key was public from the day the certificate existed, and seventeen months passed before anyone checked. That is the lesson for an operator: trust that is asserted on a data sheet is not the same as trust that is observed on the wire. Browsers fixed this with a switch. The routers, OT gateways, metering head ends and management appliances in a Canadian utility or carrier do not get that switch, and many of them have trust stores nobody has looked at since commissioning. A cryptographic bill of materials covers certificates and the roots they chain to, not just algorithms. That is what Encryption Intelligence inventories first.