One of the private keys trusted by browsers was the number 4. eMudhra, an Indian certificate authority, generated eight intermediate CA keys in April 2025 that were almost entirely zeros, recoverable in under a second.
A researcher reported them on 17 October. Mozilla recovered the keys itself that evening and browsers blocked them within hours. The board has now voted eMudhra out of the global TLS business. Nobody hacked anything; the weakness was born in the key ceremony, seventeen months earlier.
theregisterIndian certification authority eMudhra’s private keys compromised – one of them was the number ‘4’Massive clean-up job under way because this mess makes it possible to impersonate any website or service