A Certificate Authority Signed With a 4-Bit Private Key. Eight Broken Intermediates Later, eMudhra Is Quitting the TLS Business

A proper P-384 elliptic-curve private key is supposed to draw from a space of 2^384 possibilities - a number with 116 digits. Eight intermediate certificate authorities operated by India's eMudhra were published with private keys of 3 to 8 bits, meaning the strongest of them had at most 256 possible values and the weakest was literally the number 4. On Thursday, eMudhra announced it is getting out of the global SSL/TLS certificate business altogether.

The company's post-incident explanation reads like a checklist of how not to run a key ceremony. The eight intermediates were created on April 30, 2025 under eMudhra's ECC root using FIPS 140-2 Level 3 hardware security modules. An approved deviation to test a wrap/unwrap transfer between HSMs caused a code flaw that generated a second, much weaker set of keys alongside the originals; because the key labels were similar, an operator used the weak set by mistake for the certificate signing request, and the root signed it. The defective chains were even cross-signed by Sectigo, and certificate revocation lists had to be re-signed with the flawed keys after the initial signatures failed. The problem went undetected for 18 months and survived two independent audits.

Discovery came from outside. Security researcher Scott Helme reverse-engineered the public keys and found he could recover the private keys in milliseconds - the private key values were 4, 56, 66, 115, 155, 156, 230 and 237. Mozilla and Google moved to block the intermediate certificates on October 17, Apple followed on October 19, and eMudhra says it revoked the affected certificates within 14 hours of being told. Google reported that no end-entity website certificates issued under the six affected TLS intermediates had appeared in public Certificate Transparency logs before the blocks took effect, and eMudhra says there is no evidence of malicious use.

Had the keys been exploited, the blast radius was the entire web PKI: anyone holding an intermediate CA private key could mint browser-trusted certificates for any domain and impersonate websites or intercept traffic. India's CERT-In warned that the flaw could facilitate credential theft, data exposure and financial fraud, and could also let malware appear digitally signed by a trusted publisher. India's IT ministry said it is investigating the incident while pushing back on what it called fear mongering.

The exit decision came with a defensive tone. Chairman V. Srinivasan noted that SSL/TLS generates only about 1 percent of eMudhra's revenue, argued that compliance costs and free competitors had eroded its returns, and complained that "the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS's place in our business." The company committed to finish its root-program obligations, keep revocation services running until every issued certificate expires or is replaced, and deliver a full root-cause report. Google, for its part, says it is closely investigating whether eMudhra's remaining CA certificates should stay in the Chrome Root Store at all.

The long tail is the real problem. The revoked intermediates were not due to expire until April 2040, and Sonatype co-founder Brian Fox told Recorded Future News that trust stores are embedded in dozens of product categories - forgotten containers, embedded devices, vendor tools - most of which organizations have no inventory of. Mozilla's guidance specifically flagged macOS's built-in /usr/bin/curl, whose certificate bundle skips revocation checks by default, as an example of software that could keep trusting the broken chains until manually updated.

For the AI industry the episode has a specific edge: agent traffic is machine-to-machine TLS at scale, executed by frameworks that automate requests far faster than humans read certificate warnings. A root of trust that published a 4-bit key and kept it for 18 months is exactly the kind of quiet failure that automated systems neither notice nor question. As agents multiply across MCP servers, APIs and payment rails, the eMudhra incident is a reminder that the padlock on every agent connection is only as strong as the weakest ceremony behind it.