Browsers block eMudhra certificates after researcher cracks eight weak private keys
In brief
- Eight eMudhra secret keys were compromised, a researcher told browser makers on Oct. 17.
- Mozilla, Chrome, Apple and Microsoft blocked the certificates between Oct. 17 and Oct. 20.
- Scott Helme said some keys were tiny numbers, such as 4, 56 and 115.
- curl, Python, Node, Go and Java accepted a forged Stripe API certificate in Helme's tests.
- No attacks on users or crypto platforms have been reported.
How the browsers responded
eMudhra is a certificate authority, one of the companies that issue the digital certificates browsers check to confirm a site is real. It's issued more than 60 million certificates, according to The Register (as cited by CoinDesk). That's why a broken key matters: anyone who steals or cracks a certificate authority's private key can forge authentic-looking certificates for any website.
The researcher (identified in CoinDesk's report only as Wayne) used all eight compromised keys to digitally sign his warning message as proof.
Mozilla received the report after 8 p.m. UTC on Oct. 17 and had a block in place about three hours later, according to CoinDesk, which cited Mozilla's security bulletin. Chrome blocked the certificates the same day. Apple followed on Oct. 19 and Microsoft on Oct. 20. Mozilla warned that network interceptors could use the fraudulent certificates to impersonate trusted sites and read or alter user data.
Keys that were tiny numbers
Security researcher Scott Helme wrote that one of eMudhra's certificate authority private keys was the number 4, another 56 and another 115. Cyber Security News made a similar claim on X:
"According to researchers, eMudhra used tiny integers like 4, 56, and 237 as private keys instead of strong 384-bit random numbers," Cyber Security News said on X.
Helme said he recovered all eight keys in under a second from public certificates, and he said they'd been exposed since April 2025. According to Helme's reading of a Mozilla bug ticket (not a statement from eMudhra itself), the company blamed a bug in its key-setup script.
Why revocation isn't the whole fix
Revocation has a catch. Many programs never check whether a certificate has been revoked, and Helme said his tests showed tools including curl, Python, Node, Go and Java accepted a forged certificate for Stripe's API.
Fixes have shipped for Go, Python's certifi package and Rust's webpki-roots, per CoinDesk. A Node.js fix was still pending when last checked.
That's where crypto comes in.
Exchange bots, trading scripts and wallet backends often run on Python, Node or Go. A forged certificate for an exchange's API could let an attacker on the same network read or change a bot's traffic, according to CoinDesk. Nothing like that has been reported so far, and there's no sign of attacks on users.
Frequently asked questions
Why does a compromised certificate authority key matter?
Certificate authorities like eMudhra issue the digital certificates browsers check to confirm a site is real. Anyone who steals or cracks a certificate authority's private key can forge authentic-looking certificates for any website. Mozilla warned network interceptors could use such certificates to impersonate trusted sites and read or alter user data.
Are crypto trading bots and wallet backends affected by the eMudhra key issue?
Exchange bots, trading scripts and wallet backends often run on Python, Node or Go, and Helme said his tests showed those tools accepted a forged Stripe API certificate. Fixes are out for Go and Python's certifi, while Node.js was still pending when last checked. No crypto attacks have been reported.
