RESOURCE
Eight intermediate certificates issued by the Indian certificate authority eMudhra, chained to roots trusted by Apple, Google, Microsoft and Mozilla, were generated with private keys so small that anyone could recover them from the public certificate in under a second. The certificates were revoked on October 18, browsers blocked them between October 19 and 20, Mozilla removed the root, and eMudhra has said it will leave the public TLS business.
Fabric Networks
Start with a conversation about your cryptographic posture.
A security researcher checking the Common CA Database on October 17, 2026 found that eight eMudhra intermediate certificates carried private keys smaller than 256, where a proper key is a random number more than 100 digits long. With a key that small, an attacker can recover it by trying at most 256 values and then forge a valid HTTPS certificate for any domain. Six of the intermediates could issue TLS certificates and two were for code signing; all eight were cross signed by Sectigo in May 2025. eMudhra attributes the fault to a script used in an April 2025 key ceremony that produced a second, weaker set of keys with similar labels.
eMudhra revoked the certificates on October 18, Apple blocked them on October 19, Chrome and Firefox on the day of the report, Microsoft on October 20, and Mozilla removed trust in the signing root. Cloudflare, which published its own incident report on October 20, patched its clients and services before disclosure, reported no exploitation on its network, and told customers to update trust stores, review uploaded client CAs and origin certificates, and above all not to clear errors by disabling verification. Nobody can say whether the keys were used during the seventeen months they were in the wild.
Nothing was stolen here. The key was public from the day the certificate existed, and seventeen months passed before anyone checked. That is the lesson for an operator: trust that is asserted on a data sheet is not the same as trust that is observed on the wire. Browsers fixed this with a switch. The routers, OT gateways, metering head ends and management appliances in a Canadian utility or carrier do not get that switch, and many of them have trust stores nobody has looked at since commissioning. A cryptographic bill of materials covers certificates and the roots they chain to, not just algorithms. That is what Encryption Intelligence inventories first.