A critical vulnerability in eMudhra, an Indian digital certificate authority, has triggered a widespread revocation effort after private keys used to sign certificates were exposed. Mozilla’s cryptography engineer Dennis Jackson confirmed that on October 17, 2023, at 20:06 UTC, the organization received a report identifying compromised private keys linked to eight intermediate certificates issued by eMudhra. These keys, if exploited, could enable attackers to forge valid HTTPS certificates for unauthorized domains, potentially enabling man-in-the-middle attacks or service impersonation.

The compromised certificates were issued under eMudhra’s trust hierarchy, which had previously issued over 60 million certificates to establish digital trust across platforms. Browser vendors including Mozilla, Google, and Apple have since deployed updates to reject certificates signed with the exposed keys, though systems that have not applied patches remain vulnerable. eMudhra has revoked the affected certificates, but the incident has exposed systemic weaknesses in certificate issuance practices. Security researcher Scott Helme discovered that some of the compromised private keys were exceptionally weak, including one consisting solely of the number '4' — a value that renders cryptographic signatures trivial to crack. Other keys found were '56', '115', '66', '155', '156', '230', and '237', all of which fall far below industry standards for cryptographic randomness.

Experts emphasize that properly generated private keys should be 384-bit random numbers, offering approximately 10^115 possible combinations. Keys like '4' or '56' reduce security to near-zero, making brute-force attacks feasible within seconds. This flaw undermines the foundational trust model of public key infrastructure, where certificate authorities are expected to maintain rigorous key management practices. While browser updates mitigate immediate risks, the incident highlights ongoing challenges in securing the internet’s trust infrastructure, particularly among third-party certificate issuers. The full scope of affected systems remains unclear, and ongoing updates from eMudhra and downstream developers are expected in the coming weeks.