The Private Key Was the Number 4: How Eight Weak Certificate Authority Keys Set Off an Internet-Wide Scramble
A researcher noticed that eight intermediate certificates from Indian certificate authority eMudhra had private keys anyone could compute. Browsers blocked them within hours, but software that does not check revocation is still catching up. Here is the story, and what it means outside the browser.
The padlock in a browser address bar rests on a simple promise: only the certificate authority holds the private keys that vouch for a website. On Saturday, a researcher found eight places where that promise did not hold. The keys behind eight intermediate certificates issued by eMudhra, an Indian certificate authority that sells under the emSign brand, could be worked out from public data in moments. One of them, researchers later showed, was simply the number 4.
Our account follows The Hacker News’ detailed and updated report, with additional details from BleepingComputer.
A message signed eight times
The researcher, credited by Mozilla only as Wayne, reported the problem to the browser root programs on October 17 and proved it by signing the same short message, “We have a problem here,” with each of the eight keys. Six of the certificates could vouch for websites at domain, organization and extended validation levels, and two were for code signing.
The reaction was fast. Chrome confirmed the finding and pushed a block to the six web-facing intermediates in under two hours. Mozilla did the same for Firefox that evening, and its engineers recovered the keys independently within two hours of the report. Apple and Android devices were covered on October 19 and Microsoft on October 20. Because Chrome and Firefox fetch these block lists on their own, users did not need to update or restart.
Not stolen, just guessable
Early coverage assumed the keys had leaked. They had not. According to Mozilla’s incident report, as described by BleepingComputer, each key was a value below 256, so anyone could find it by trying 256 numbers. Researcher Scott Helme wrote that he recovered all eight on a laptop in under a second, and that an AI agent did the same from a single prompt.
eMudhra says the certificates came out of a key ceremony on April 30, 2025, using certified hardware security modules, and that a flaw in a wrap-and-unwrap step produced a second, weak set of keys alongside the strong ones. The weak set is what ended up in the browser trust stores. The company says only one of the eight intermediates was ever used in production, none issued a certificate to a customer, and its infrastructure was not breached. It is still investigating the root cause.
The part that is not finished
Browsers were the easy part. Chrome found no certificates chaining to the six web intermediates in public Certificate Transparency logs before its block, so none could have been trusted by default in browsers that require those logs. Whether anyone abused the keys outside that view since April 2025 is not known.
Much other software does not check revocation at all and keeps trusting a chain until its code or its bundled list of trusted roots changes. That is why the fixes are spreading in waves: Go added a hard-coded block in emergency releases, Python’s certifi bundle and other root lists dropped eMudhra’s ECC root, Linux distributions are updating their certificate packages, and Cloudflare shipped updated clients. Mozilla engineer Dennis Jackson’s tracking site warns that the curl built into macOS still accepts the chain.
Removing a root has side effects. Chrome plans to drop the same eMudhra root from devices relying on its root store on the morning of Tuesday, October 27, Pacific time, so any website still using a certificate that chains to it must switch before then.
Why this is trending
It is the rare security story that sounds like a joke and is not. A key that is literally a single digit, recoverable by an AI agent from one prompt, sat inside the trust stores of the major browsers and operating systems for well over a year. eMudhra’s shares fell 20% in Mumbai on October 21, according to Business Standard as cited by The Hacker News.
What this means for your company
For everyday browsing, keep browsers updated and do not disable their automatic security settings. The bigger homework is everything else that makes encrypted connections: line-of-business apps, scripts, containers, appliances, and tools built in Go or Python. Ask your developers and vendors whether they have picked up the updated trust lists, and patch operating systems so their certificate packages refresh. If any of your own websites or services happen to use an emSign certificate, replace it with one from a different hierarchy before October 27.
Need help checking which of your systems still trust the revoked certificates, or replacing certificates before a deadline? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
