A Certificate Authority Just Got Caught Using a Private Key of 4

Highlights

• Eight eMudra intermediate certificate authority private keys created in April 2025 consisted of extremely small numbers such as four, fifty-six, and sixty-six instead of random 384-bit values.

• A Python script running on a personal computer cracks these weak cryptographic keys in under one second.

• Browsers blocked the compromised certificates within days, but non-browser software like curl, Python, Node, Go, and Git accepted forged certificates because they do not check certificate transparency logs.

• A hardware security module script bug during a test export generated the flawed key pairs, and eMudra ignored earlier warning signs from invalid revocation list signatures in June 2025.

• Cloudflare shipped software updates and Go pushed an emergency standard library release to block the eight compromised intermediates.

Timeline

1. 00:40 - 01:21

   Discovery of Compromised eMudra Certificates

   Security researcher Wayne notified Apple, Google, Microsoft, and Mozilla that eight eMudra intermediate certificates signed by Sectigo were compromised. To prove the vulnerability, Wayne signed a message with every single one of the affected keys.

   • A security researcher named Wayne reported eight compromised eMudra intermediate certificates to major tech companies on October 17th.
   • Six of the compromised certificates are TLS-issuing CAs and two are code-signing CAs created in April 2025.
   • Chrome and Firefox blocked the certificates within hours, while Apple and Microsoft followed over the next three days.
2. 01:21 - 02:47

   Cryptographic Flaws in the P-384 Keys

   Standard P-384 keys provide roughly ten to the power of 115 possibilities, making brute-force attacks impossible. However, the flawed eMudra keys had a single byte value, allowing a simple script to test values sequentially until a match occurred. Despite having a private key of four, the certificates produced valid curve points and passed structural checks.

   • The elliptic curve keys use the P-384 curve where the private key D is supposed to be a random 384-bit number.
   • eMudra keys consisted of 47 bytes of zeros followed by a single byte containing values like 4, 56, and 66.
   • A basic Python script computes scalar multiplications sequentially and cracks all eight keys in under one second.
3. 02:47 - 03:45

   Root Cause and Missed Warning Signs

   The weak keys originated from a testing script bug that generated duplicate key pairs with similar names on a hardware security module, leading personnel to pick the wrong pair during certificate generation. Warning signs appeared months prior when Sectigo flagged invalid revocation list signatures, but the issue went uninvestigated.

   • A modified key ceremony script for testing exports created a second weak key pair on eMudra's hardware security module.
   • Sectigo reported invalid signatures on eMudra revocation lists in June 2025 because eMudra signed them with strong keys instead of the weak active keys.
   • eMudra re-signed the lists with the weak keys instead of investigating the underlying discrepancy.
4. 03:45 - 05:16

   Impact on Browsers, Non-Browser Software, and Devices

   While modern web browsers reject unlogged certificates, command-line utilities and development environments like curl, Python, Node, Go, and Git trust whatever certificate authority bundle resides on disk. This exposes installation scripts, CI runners, and server-to-server API calls to exploitation. Furthermore, static devices like routers and smart TVs retain these roots until 2039.

   • Browsers remain secure because they check public certificate transparency logs, but non-browser tools rely entirely on local CA bundles.
   • Security researcher Scott Helm successfully forged a stripe.com certificate accepted by curl, Python, and Node on Linux and macOS.
   • Smart TVs, routers, and embedded devices without updates will trust these certificates until they expire in July 2039.
5. 05:16 - 07:48

   Industry Cleanup, Mitigations, and Immediate Actions

   The post-incident cleanup involves emergency software updates across major infrastructure providers and toolchains. Mozilla and Chrome's removal of eMudra roots threatens to break thousands of active sites. Developers can verify their client safety by running curl against test domains associated with the incident and updating their local certificate bundles and programming runtimes.

   • Cloudflare updated its warp client, app, and tunnel software, while Go released an emergency update blocking the eight intermediates.
   • Mozilla and Chrome are removing eMudra's root entirely, giving eMudra roughly a week to migrate 30,000 certificates.
   • Developers must update certificates packages, bump Go versions, rebuild container images, and test clients using curl against specific verification endpoints.