"Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4..."
That line, written by security researcher Scott Helme and lifted verbatim from The Register's reporting, captures the depth of the failure at Indian certification authority eMudhra: private keys so trivial they were little more than single-digit integers were in use for keys that underpin digital trust for millions of websites. The consequence is immediate and concrete: certificates issued by eMudhra—the company says it has issued over 60 million digital certificates—cannot be trusted without extensive verification and cleanup.
Mozilla's timeline and the initial report
Mozilla first learned of the problem on Saturday, October 17, at 20:06 UTC, when it received "a report from a community member that private keys associated with eight eMudhra intermediate certificates had been compromised," wrote Dennis Jackson, a member of Mozilla’s cryptography engineering team. Jackson warned that "these keys could allow attackers to issue fraudulent HTTPS certificates for websites they do not control," a foundational risk for anyone relying on TLS to secure web traffic.
Jackson has since elaborated on the incident and the coordinated response. That initial public disclosure, reported by The Register on Tuesday, set off action by multiple browser vendors and open-source maintainers.
Scott Helme's recovery: private keys of "4", "56", "115" and more
Independent analysis cited by The Register shows how egregious the cryptographic failures were. Scott Helme recovered private keys from eMudhra’s public certificates and found some that were trivially small: "4," and others that were equally inadequate—Helme named 56 and 115 specifically. The Register also reports that other researchers found private keys including the numbers 66, 155, 156, 230 and 237.
Helme explained why this matters in technical terms: "A P-384 private key should be a random 384-bit number, which gives you 2³⁸⁴ possibilities (or roughly 10¹¹⁵), so nobody is ever going to search that." By contrast, a tiny integer like 4 is trivial to guess, making every certificate signed by those keys susceptible to brute-force recreation and misuse.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleBrowser vendors, FOSS updates, and eMudhra's revocation
Within hours of the disclosure, major platform providers and maintainers moved to limit exposure. Mozilla, Google Chrome, and Apple implemented remediations so their browsers "won't rely on the certificates"—with the caveat that users must install updated browser versions to receive protection. Jackson also reports that eMudhra has revoked the affected certificates.
Open-source projects were not idle: "many FOSS projects" have issued updates that mean they will no longer recognize certificates from eMudhra, according to The Register's account. Still, the article emphasizes a key operational problem: certificates already issued and in active use remain in the wild, and "many services rely on them."
The Register reached out to eMudhra for comment on the incident and its security practices; as of publication eMudhra "has not responded" to those inquiries.
How technologists, affected enterprises, and end users will respond
- Technologists and security teams: Teams will need to inventory systems to identify any services relying on eMudhra-issued certificates and replace or reissue certificates where necessary. Developer Geoffrey Huntley has "offered some advice on automating that process," a practical step for large-scale searches and remediation.
- Affected enterprises and procurement leaders: Organizations that accepted eMudhra certificates as part of procurement or operation must verify trust chains and not assume that browser-blocking is sufficient. The Register notes that "browser makers are set up to detect and reject bad certs" but warns that "others who relied on them may not be"—meaning internal services, embedded devices, or third-party vendors might remain vulnerable.
- End users and the general public: Users obtain immediate benefit by installing browser updates from Mozilla, Chrome, and Apple; those updates are intended to prevent the browsers from trusting certificates signed with the compromised keys. But protection will be uneven until all endpoints are updated.
Cloudflare summed up the operational risk plainly: "an attacker can create a forged certificate for any domain and use it to impersonate servers to intercept or modify traffic." That is not speculation but the direct consequence of private keys that are trivial to reconstruct.
The record so far is one of rapid vendor response and an outstanding operational headache. eMudhra's revocations and vendor updates reduce the immediate risk to browser users who update their software, but millions of certificates and services must be found and fixed. As The Register notes, this remains a developing story; the public will be looking for fuller explanations from eMudhra, confirmation that all affected keys have indeed been revoked, and for automated tools—such as those recommended by Geoffrey Huntley—to help organizations sweep their environments.
