eMudhra Certificate Authority Keys Cracked in Under a Second After Using Single-Digit Integers

Eight private keys belonging to Indian certificate authority eMudhra were compromised after researchers discovered the company used easily guessed integers like 4, 56, 115, and 237 instead of standard 384-bit random numbers. Security researcher Scott Helme stated he recovered all eight keys from public certificates in under a second, adding that the weak keys had been exposed since April 2025 due to what eMudhra blamed on a bug in its key-setup script. A researcher named Wayne initially reported the flaw to browser makers on October 17 by using all eight compromised keys to digitally sign a warning message. eMudhra, which has issued more than 60M certificates according to The Register, revoked the intermediate certificates, while Mozilla, Chrome, Apple, and Microsoft rolled out blocks between October 17 and October 20. Although no attacks on users have been reported, Helme warned that non-browser software rarely checks certificate revocation statuses, noting his tests showed curl, Python, Node, Go, and Java accepted a forged certificate for Stripe's API before emergency patches began rolling out. "One of eMudhra's certificate authority private keys is the number 4. Another one is 56, and another is 115." — Scott Helme, Security Researcher.