Browser Makers Block 8 eMudhra TLS Certificates as Weak Keys Threaten Internet Trust
Updated
Updated · Ars Technica · Oct 20
Browser Makers Block 8 eMudhra TLS Certificates as Weak Keys Threaten Internet Trust
3 articles · Updated · Ars Technica · Oct 20
Summary
Eight eMudhra intermediate TLS certificates were blocked Tuesday by browser makers, major apps and some programming languages after researchers showed one private key was compromised.
The weak keys could let attackers mint browser-trusted certificates for any website or app credential, though certificate-transparency logs had not shown malicious use by late Tuesday morning.
A signed message on an advisory site proved control of one eMudhra key, triggering a rapid response because the same trust chain is accepted by millions of servers worldwide.
Linux distributions were still rolling out fixes, and cryptography maintainers warned IoT devices, embedded systems, Docker containers and neglected machines could take far longer to update.
Filippo Valsorda called the cleanup bigger than Heartbleed, pointing to a long tail of software that ships its own root stores and may remain exposed for years.
Why are standard security revocations failing to protect countless embedded systems from this catastrophic cryptographic failure?
If researchers had not found this flaw, how long would attackers have controlled the internet's trust system undetected?
How could a simple mathematical error silently compromise the security of millions of forgotten IoT devices worldwide?
2026 eMudhra Intermediate Key Compromise: How a Single Entropy Flaw Exposed Global PKI Weaknesses
Overview
A critical cryptographic breach at eMudhra was caused by a PKI software misconfiguration that overrode the HSM’s entropy, leaving only one byte of randomness during P-384 key generation. This flaw reduced the private key search space from 2^384 to just 256 possibilities, allowing anyone with the public key to extract the private key in milliseconds. Security researchers quickly disclosed the issue, prompting Chrome and Mozilla to block the compromised keys within hours. However, non-browser applications remained exposed until manual updates were applied. The incident revealed gaps in audit processes and forced downstream maintainers to remove entire root certificates, disrupting legitimate services and highlighting the urgent need for automated certificate management and stronger operational controls.