eMudhra Revokes Eight Certificates with Trivially Weak Keys

An implementation error in eMudhra’s certificate generation script produced eight intermediate certificates with dangerously weak private keys. A flawed script created inferior cryptographic material that was then mistakenly selected over properly generated keys. The resulting private keys were so small that all possibilities could be tested in seconds—one notably had a value of just 4. This vulnerability potentially enabled attackers to forge certificates for any domain eMudhra authorized and intercept encrypted communications.

Researchers discovered the compromise on October 17, and browser vendors moved quickly to protect users. Mozilla deployed blocking through its real-time revocation system the same day, while Google Chrome followed with six affected intermediates and Apple added protections two days later. Mozilla released updated browser builds for users whose configurations prevented remote revocation updates, and the Go team issued compiler patches. The protections remain incomplete: systems using bundled certificate stores without revocation checks—including macOS’s built-in curl utility—could continue trusting the compromised certificates unless patched separately.

eMudhra found no evidence the keys were exploited before discovery, though attackers could have abused them since their creation five months prior. The CA halted new certificate issuance under its G3 root and revoked the eight problematic intermediates. Administrators should verify their systems’ vulnerability using published test endpoints and install available updates to eliminate the risk.