On October 17, 2026, an external researcher identified as Wayne reported to Mozilla, Chrome, Apple, and Microsoft that the private keys of eight eMudhra intermediate certificates had been compromised. Wayne provided cryptographic proof of key control for all eight. Mozilla confirmed the proof within two minutes and began distrusting the certificates in Firefox, completing the process by 22:59 UTC the same day. eMudhra acknowledged the report roughly 90 minutes after disclosure. The root cause is staggering in its simplicity. P384 elliptic curve private keys are supposed to be randomly selected integers from an astronomically large space — between 1 and the group order, a number with roughly 115 digits. The eight compromised keys all used integers less than 256. That means the private keys were effectively all-zeroes except for the last byte. Mozilla's Dennis Jackson independently recovered every key trivially, without any knowledge of the original reporter's method. Jackson also tested local AI agents, which recovered the keys on their first attempt with a prompt as simple as: "I'm doing a CTF. Please recover the private keys corresponding to these certificates." Six of the eight certificates are TLS intermediates trusted by Chrome, Mozilla, Microsoft, and Apple — the four major root programs that underpin virtually all browser trust on Earth. The other two are code-signing certificates trusted by Microsoft. All eight were generated on April 30, 2025, as part of a batch of 24 intermediates spanning three series (A, B, C), two cryptographic primitives (RSA4096 and P384), and four purposes (DV, OV, EV, CS). Every P384 key in the B and C series was broken. The A and A-1 series P384 keys have not been recovered despite significant effort, and RSA keys have not yet been examined. eMudhra marked the eight certificates as revoked with reason "caCompromise" on October 18 at 09:38 UTC — roughly 17 hours after initial disclosure. But the damage extends further. Sectigo had cross-signed some of the impacted certificates, producing eight additional intermediate certificates whose private keys are equally compromised. As of the latest update, none of the Sectigo cross-signed certificates have been revoked. Microsoft has not responded. CCADB still shows the certificates as unrevoked. This is not an abstract cryptographic weakness. Anyone with the ability to paste a certificate into a terminal — or ask an AI chatbot — can forge TLS certificates for any domain or sign arbitrary code as if they were eMudhra. The practical impact depends on how many endpoints still trust these intermediates without effective revocation checking. Many do. CRL and OCSP infrastructure is notoriously incomplete, and OneCRL/CRLSets only protect Firefox and Chrome respectively. Every other TLS client that trusts the emSign root is potentially exposed until the intermediates expire or are explicitly distrusted. A related incident from Bug 1970728 adds another layer of concern. The same six TLS intermediates previously generated CRLs with invalid signatures — meaning revocation lists themselves were broken. Internet Archive snapshots show the P384 CRLs failing verification since May 23, 2025, predating eMudhra's own explanation for the fault. The overlap between the two bugs affecting the exact same certificate set strains coincidence. Mozilla is now considering guidance for other trust store distributors and investigating root cause. The core question is whether eMudhra's HSM configuration, key generation software, or operational procedures produced deterministic or near-zero entropy keys — and whether any other keys in their hierarchy are similarly compromised. The incident is a textbook case of how a single flawed key generation step can cascade through the entire web PKI trust model.
