The private keys guarding eight of eMudhra’s intermediate certificate authorities were not really private at all. The keys, created for the Indian trust provider’s emSign business, were elliptic-curve keys whose secret values were small integers — all below 256, and one of them simply the number 4. Anyone who knew that could recover the keys almost instantly and, in principle, mint trusted certificates for any domain.
An independent researcher found the flaw and reported it to the four major browser root programs — Apple, Google, Microsoft and Mozilla — on Saturday, October 17. The browsers blocked the eight certificates within hours, and the response has since escalated: Mozilla removed the emSign ECC Root CA – G3 root on October 20, Chrome will complete the same removal by October 27, and eMudhra confirmed the failure in a statement on Wednesday, October 21, the same day CERT-In issued an advisory and India’s IT ministry set up a team to investigate.
Keys That Could Be Counted To
The eight intermediates — six for TLS website certificates and two for code signing — were created on April 30, 2025, in a formal key generation ceremony under eMudhra’s ECC root, using FIPS 140-2 Level 3 hardware security modules. A P-384 key is supposed to be a random 384-bit number. These were not: every secret value was an integer under 256, so recovery is a counting exercise — multiply the curve’s generator point by 1, then 2, then 3, and stop when the result matches the public key. One key fell at 4.
There is one piece of good news. Certificate Transparency logs show no certificates issued from these intermediates since April 2025, so browsers that enforce transparency could not have been fooled by a logged certificate from them. The two code-signing intermediates carry no such reassurance: code-signing certificates are not publicly logged, so there is no record of what they signed.
How The Root Programs Responded
Chrome pushed a CRLSet block on the evening of October 17, and Firefox blocked the certificates through OneCRL the same night; Apple followed on October 19 and Microsoft on October 20. eMudhra revoked all eight intermediates on October 18, and Sectigo revoked its cross-signed copies a day later. The root programs then went further: Mozilla removed the emSign ECC Root CA – G3 root entirely in NSS 3.131.1 on October 20, and Chrome is removing the same root, with the change expected to reach all devices by October 27. Mozilla is not removing the older emSign Root CA – G1 at this time.
The harder problem sits outside the browsers. Servers, containers and apps with their own frozen trust stores do not receive OneCRL or CRLSet updates — which is why the guidance from Mozilla and CERT-In is aimed at operators: update trust stores, and replace any certificate chaining to the G3 root before Chrome’s removal makes the break permanent.
eMudhra’s Explanation And The CERT-In Probe
In its October 21 statement, eMudhra said a flaw in the key ceremony’s wrap/unwrap step produced a second set of weak keys alongside the original strong ones, and the weak set is what was published to the browser root stores. The company said its infrastructure was not compromised and no data was breached. The affected global TLS business is separate from its Indian digital signature and eSign services, which it says are unaffected, and accounts for around 1% of revenue — though it conceded reputational risk it cannot quantify. It is issuing replacement certificates to affected customers, and notes the CAs passed independent audits two years running.
The incident record contains an earlier missed warning. In May 2025, signatures on certificate revocation lists began failing because the signing system was using the strong keys while the published certificates carried the weak ones; rather than treating the mismatch as a key problem, the team reconfigured the signer to use the weak keys and closed the issue. CERT-In’s advisory urged users to update browsers and operating systems and replace affected certificates. A MeitY official said a special team has been constituted to investigate, and described the impact on Indian websites as limited and brief.
Why It Matters
An intermediate CA key is one of the highest-value secrets on the web: it sits above every certificate that CA issues, so its compromise is a hole in the trust fabric every browser relies on. The eMudhra failure is striking because nothing was hacked — the keys were born weak inside a scripted, audited ceremony, survived two audit cycles, and were caught only because an outside researcher tried counting. It lands in the same month as two other trust-layer failures GEroundtable has covered: the LiteLLM PyPI release that hid a credential stealer in every wheel and the critical PHP flaws AI models helped surface. The parallel with Claude tracing the NIST curve seeds to a 1990s clock is hard to miss: cryptography keeps failing at its roots, in how keys and constants are generated, long before it fails in the mathematics.
Background
eMudhra is a Bengaluru-based digital trust company, listed on India’s NSE and BSE, with more than 17 years in digital identity and certificate services; its global TLS certificates are sold under the emSign brand. Browser distrust is the web’s ultimate sanction against a certificate authority, used only a handful of times in the history of the public web PKI, because removing a root breaks every legitimate certificate beneath it. The October 27 Chrome deadline is now the date that matters for any operator still chaining to emSign’s G3 root.
Source: eMudhra; The Hindu BusinessLine
0 Comments