eMudhra’s Weak Key Generation Exposed Eight Intermediate CA Keys
Summary
Aikido reports that eight eMudhra intermediate CA private keys were recoverable because they were smaller than 256, including one equal to 4. Browsers have blocked the certificates, but other trust stores may need updates; the article says attacker use is unknown.
Key points
- According to Aikido’s analysis, all eight intermediate CA private keys were below 256; one was 4, far short of the roughly 10^115 possible values expected for a properly generated key.
- Researcher Wayne demonstrated control by signing the message “We have a problem here” with each key and reported the issue to browser and operating-system root program teams on October 17, 2026.
- The intermediate keys could be used to sign valid certificates for any domain; two of the eight certificates were Microsoft-trusted code-signing CAs.
- Firefox and Chrome blocked the certificates on October 17, Apple devices on October 19, and Microsoft platforms on October 20. eMudhra revoked them on October 18.
- The article says attackers would need a network position to use forged certificates, and reports that the intermediates did not appear in certificate transparency logs before blocking. Whether attackers used the keys is unknown.
- Servers, containers, CI pipelines, command-line tools, and language runtimes may still trust the certificates if they do not check revocation or retain old CA bundles.
- The recommended response is to update operating systems and CA bundles, rebuild affected images, and update runtimes with bundled roots; the article notes Aikido flags affected container images.
Article Details
- Event Type
- Compromise of eight eMudhra intermediate CA private keys caused by faulty key generation.
- Impact
- According to the article's analysis, all eight private keys were recoverable from public certificates and had values below 256; one was 4. The keys could be used to issue certificates for any domain and, for two code-signing intermediates, to sign malware under any publisher name. Browsers and platforms blocked the certificates, but servers, containers, command-line tools, and runtimes that do not check revocation may still trust them until updated. The article says it does not know whether attackers used the keys.
People
Vendors
AikidoHow Aikido helps: Aikido flags container images that still carry the affected certificate bundles as Critical or High issues.AppleMost browser users are covered. Firefox and Chrome have blocked the certificates since October 17, Apple devices since October 19 and Microsoft platforms since October 20, using the revocation lists their vendors pusheMudhraeMudhra, a certificate authority that all the major browsers trust, generated the private keys for eight of its signing certificates in a way that meant one of them is just the number 4, about as easy to guess as a keyGoogleMozilla, Google, Apple and Microsoft distribute revocation information to their browsers through mechanisms such as OneCRL, CRLite and CRLSets, so a bad intermediate can be blocked without waiting for a software update.MicrosoftFirefox and Chrome have blocked the certificates since October 17, Apple devices since October 19 and Microsoft platforms since October 20, using the revocation lists their vendors push to users.Mozillakey can sign a valid certificate for any domain. These eight chain up to emSign ECC Root CA - G3, which Mozilla has removed from its trust store and which Chrome expects to follow on October 27.
Products
Device ProtectionWe also released Device Protection v1.10.20 as a hotfix for this issue. If you use Device Protection, we advise updating to it.Edgein certificate transparency logs before the block, so clients that enforce transparency (Firefox, Chrome, Edge and Safari) could not have been attacked. Clients that do not enforce it could have been targeted, and theGoogle ChromeMost browser users are covered. Firefox and Chrome have blocked the certificates since October 17, Apple devices since October 19 and Microsoft platforms since October 20, using the revocation lists their vendors pushMozilla FirefoxMost browser users are covered. Firefox and Chrome have blocked the certificates since October 17, Apple devices since October 19 and Microsoft platforms since October 20, using the revocation lists their vendors pushSafaritransparency logs before the block, so clients that enforce transparency (Firefox, Chrome, Edge and Safari) could not have been attacked. Clients that do not enforce it could have been targeted, and the site says