Eight CA keys were almost all zeroes. Mozilla, Google, Apple and Microsoft cut them off.
By Lior AharonovFounder, 7IT Solutions ·
Private keys for eight intermediate certificates that the Indian CA eMudhra issued in April 2025 could be recovered almost instantly; Mozilla's Dennis Jackson says they were effectively all zeroes apart from the last byte. Mozilla and Google blocked them on 17 October 2026, Apple on 19 October and Microsoft on 20 October, and eMudhra revoked the certificates.
Whoever holds such a key can sign a certificate for any website, yours included, and a client that still trusts it shows the padlock. SecurityWeek reports no sign of misuse in Certificate Transparency logs, but not every client checks those logs.
Update browsers, operating systems and every app or container image that bundles its own CA list today. If you pin certificates, confirm none of them chains to an eMudhra intermediate issued in April 2025.
Encryption is only as strong as the dice someone rolled once. These dice had one face.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.