On October 17, 2026, researchers simultaneously disclosed a critical vulnerability to Apple, Google, Microsoft, Mozilla, and the Certificate Authority eMudhra: eight intermediate CA certificates issued by eMudhra used private keys that were single-byte integers—specifically, the numbers 4, 56, 66, 115, 155, 156, 230, and 237.
These certificates rely on the elliptic curve P-384. Under cryptographic standards, a private key must be a 384-bit cryptographically secure random number chosen from a keyspace of roughly 3.9 × 10¹¹⁵, where brute-force search is impossible. But when the private key is merely a scalar like 4 or 56, an attacker only needs to compute base-point multiplications: 1×G, 2×G, 3×G… up to 255×G to recover the private key. Security researcher Scott Helme managed to recover all eight private keys—spanning 16 certificates—in less than one second on an off-the-shelf laptop.
Fully Valid on the Surface
The failure happened in the blind spot of automated compliance checks: while these eight private keys suffered from near-zero entropy, their structural validity was completely unblemished. Multiplying the P-384 base generator by 4 produces a mathematically valid point on the curve, with proper formatting, valid curve parameters, and passing digital signature algorithms. The certificate chain, validity periods, and standard extensions were all impeccably formed.
Detecting the anomaly required actively testing small integers—a check that had never been part of standard CA compliance audits. That oversight explains why these compromised certificates survived on the public Internet undetected for 17 months.
Issued in April 2025, the eight intermediates comprised six TLS issuance CAs (spanning two generations of DV, OV, and EV) and two code-signing CAs. In May 2025, they were cross-signed by Sectigo’s AAA Certificate Services root, expanding the affected footprint to 16 certificates in total. Their designated expiry was set for July 2039.
Another uncomfortable detail emerged from eMudhra’s official response: the organization maintained that the private keys had been stored in Hardware Security Modules (HSMs) throughout their lifecycle. If true, the HSM was merely faithfully guarding a key whose scalar value was 4—highlighting that hardware compliance and cryptographic entropy are completely orthogonal concerns. As community discussions quickly pointed out: because keys were sealed inside the HSM, administrators likely never inspected the key material directly, leaving completely unnoticed the fact that the underlying random number generator had never functioned.
Figure: The brand identity of Certificate Authority eMudhra. Eight of its intermediate certificates remained silently exposed on the public internet for 17 months. Source: Scott Helme blog via eMudhra official site
Signing Stripe with Private Key 4: curl Said Yes
With private keys effectively public knowledge, forging valid signatures became trivial.
Scott Helme used private key 4 to issue a certificate for api.stripe.com, spun up openssl s_server locally, and connected using standard client tools. The outcome was stark: curl on Linux and macOS reported SSL certificate verify ok; Python’s TLS handshake completed without complaint; Node.js returned authorized: true; and Windows CryptoAPI accepted the connection unconditionally as long as real-time revocation checks were not strictly enforced.
The dividing line lies in trust store architecture. Web browsers rely on centralized, dynamically pushed trust infrastructure: Chrome pushed the affected certificates into its CRLSet within hours on October 17, Mozilla followed rapidly via OneCRL, and on October 20 Mozilla published a formal advisory and stripped the eMudhra root from NSS, with Chrome subsequently purging trust in its Root Store version 43. Furthermore, mandatory Certificate Transparency (CT) logs proved invaluable: audits confirmed no forged certificates had surfaced in CT logs, sparing ordinary web browsing from direct harm.
Command-line utilities, backend SDKs, and IoT appliances follow an entirely different paradigm. Their root stores are distributed as static bundles bundled at build time; they rarely query revocation endpoints by default and completely ignore CT logs. In these environments, certificates long revoked by browser vendors remain fully trusted credentials.
Figure: The point of failure in digital trust chains lies not in the underlying math, but in key generation. Source: Ars Technica
Revocation Stopped at the Browser
Mapping the blast radius illustrates how long the security hangover will last.
curl | sh bootstrap installers (such as rustup, nvm, or Homebrew), when relying on HTTPS integrity, could allow attackers in an active position to impersonate upstream mirrors and inject malicious binaries directly onto developer workstations with elevated privileges. CI/CD pipelines face even higher stakes: runners on GitHub Actions, GitLab, and Jenkins frequently handle production cloud secrets and deployment credentials, running on images where system trust stores are almost never manually updated. Inter-service traffic (payment gateways, webhooks, OAuth flows) relying on base OS image CA bundles falls squarely within range. Compounding the damage is Windows code signing: forged certificates rooted in eMudhra’s code-signing CAs would produce binaries treated as legitimate software on machines without active revocation checks.
Cryptographer Filippo Valsorda noted that the cleanup burden may eclipse Heartbleed: forgotten Linux servers, orphaned container images, and legacy CLI tools bundled with static root bundles will leave a lingering tail. Ben Cartwright-Cox speculated that sample test code may have inadvertently escaped into production, underscoring that the true scandal was eighteen months passing without a single audit flagging it. Ian Carroll captured the systemic gravity succinctly: these single-byte keys can be reconstructed by anyone, and once exposed, there is no way to pull them back.
A 13-Year Security Tail
Remediation options on the operations side remain severely constrained. On managed infrastructure, revoking eMudhra roots or adding intermediates to blocklists is standard practice; OpenSSL-dependent systems must ensure host certificate stores are refreshed. The unmanageable long tail is where the real danger sits: home routers, security cameras, industrial controllers, automotive systems, and POS terminals ship with burned-in, immutable trust stores. Once vendors abandon software maintenance, the hardware cannot be updated short of complete replacement—leaving a vulnerability window open until the certificates reach natural expiration in July 2039.
For systems designers and engineering teams, the incident offers a sobering architectural lesson. Bundling a static root store may save a network roundtrip during validation, but the trade-off is severing revocation pathways for the next decade. Placing complete faith in the assumption that “nobody can view the private key” collapses the moment a random number generator fails to initialize.
References:
- Scott Helme Technical Blog
- We Have A Problem Incident Report
- Ars Technica In-Depth Analysis
- Mozilla Official Security Blog
- Hacker News Community Technical Discussion
