eMudhra Quits Global TLS After a Private Key of 4

eMudhra said on October 22 that it will leave the global SSL/TLS certificate business, five days after researchers showed one of its private keys was the number 4. The Bengaluru firm, listed as EMUDHRA, said online reaction was out of proportion to a line that brings in about 1% of revenue.

By October 23 the shares were at ₹331 on the BSE, about 39% below the October 19 close of ₹540. Chairman V. Srinivasan said the board would withdraw from the global SSL/TLS business and put the energy into enterprise products. Digital signatures for Indian customers, he said, sit on other systems and keep running.

Eight Keys, One of Them 4

The product a certificate authority sells is a private number nobody else can guess. For the P-384 curve eMudhra used, that number is supposed to be picked from about 10^115 possibilities. Security researcher Scott Helme pulled all eight of the weak keys from the public certificates on a laptop in under a second. One of them, on EM OV TLS CA – G3C, was the number 4.

One of eMudhra’s certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4.

Scott Helme, security researcher

The other seven values were 56, 66, 115, 155, 156, 230 and 237. Each fits in a single byte, so a search is at most 255 steps of adding the curve’s base point to itself until the public key in the certificate matches. Helme wrote that nothing in the files looks broken: the point sits on the curve, the encoding is valid, and every structural check passes. The only way to find the secret is to try.

THE EIGHT PRIVATE KEYS

Six of the eight could mint website certificates. Two could sign software. Each key also exists in a copy cross-signed in May 2025 by Sectigo under its AAA Certificate Services root, so there are 16 certificates sharing those eight secrets. Anyone who held one TLS key could issue a certificate for any domain that still trusted the chain.

A researcher who goes by Wayne reported that to Apple, Google, Microsoft, Mozilla and eMudhra on October 17, 2026. As proof he signed the line “We have a problem here – Wayne” with each key. He had run Google’s paranoid_crypto key-testing tool, a public checker released in 2022, over the Common CA Database. Mozilla recovered the same keys on its own by 21:48 UTC that evening, with no knowledge of his method.

How a Wrap Test Produced Keys Below 256

eMudhra traces the flaw to a key-generation ceremony on April 30, 2025, run on Utimaco modules rated FIPS 140-2 Level 3. Co-founder Kaushik Srinivasan later called it a one-off incident on a bad day and said a script error can happen to anybody. In Mozilla’s public incident ticket the company said an approved extra step, a wrap-and-unwrap test for keys meant for data centres in Europe and the United States, produced a second, weaker pair on the module. Labels looked alike. Staff used the weak pair to build the certificate requests. The root signed them. Sectigo cross-signed them two weeks later.

Srinivasan said the team that ran the ceremony was experienced and that the team leader had been with the firm for 15 years. He also said the control lapses happened, it was a script error, and the firm should have checked. The certificates went into the shared CA database on May 10, 2025, two days late, and sat there in public.

FROM THE CEREMONY TO THE BLOCK

1. April 30, 2025: Ceremony creates the G3B and G3C issuing CAs on Utimaco hardware, with a wrap-unwrap test in the script.
2. May 10, 2025: All 24 new issuing CAs from the batch go into the Common CA Database, which makes the public keys world-readable.
3. May 14, 2025: Sectigo cross-signs the eight weak intermediates from AAA Certificate Services.
4. June 5, 2025: Public Mozilla bugs record CRL signatures that do not match the certificates on these CAs.
5. June 6, 2025: eMudhra publishes CRLs that verify, signed with the weak keys that match the certificates.
6. October 17, 2026: Wayne reports to the root programs; Chrome blocks the six TLS intermediates by 19:45 UTC; Mozilla finishes OneCRL at 22:59 UTC.
7. October 18, 2026: eMudhra revokes all eight intermediates between 09:24 and 09:38 UTC, reason ca_compromise.
8. October 19, 2026: Sectigo revokes the eight cross-signs at 10:35 UTC.
9. October 20, 2026: Microsoft blocks the certificates; Mozilla ships NSS 3.131.1 without emSign ECC Root CA – G3.
10. October 22, 2026: Apple’s block is in place on the disclosure site’s timeline; eMudhra’s board votes to leave global SSL/TLS.

The June 2025 CRL bugs are the part the exit statement skips. eMudhra later told Mozilla the first lists had been signed with the original, stronger keys, so the signatures failed. The fix was to re-sign with the flawed keys, because those were the keys the certificates named. From that point the company was using secrets that anyone could compute, and it kept those CAs in the hierarchy until Wayne’s email 16 months later.

Browsers Closed the Hole in Hours

Mozilla received the report at 20:06 UTC on October 17 and had Firefox’s OneCRL block out by 22:59 UTC, 2 hours and 53 minutes later, with no restart required. Chrome pushed a CRLSet update the same evening. Microsoft followed on October 20. The disclosure site run by Mozilla cryptography engineer Dennis Jackson records Apple’s block from October 22. Packaged Firefox 158.0.1, plus ESR builds 115.43.1 and 153.5.1, covered installs that do not take remote settings.

eMudhra says it revoked the affected CAs within 14 hours of discovery, issued no end-entity certificates from them, and suffered no break-in and no data loss. Certificate Transparency logs for the window are empty, which is why Chrome, Firefox, Edge and Safari, which demand CT, were unlikely to have trusted a forgery. Jackson’s write-up is blunt about the rest of the stack: many clients never look at revocation lists and never look at CT, so they keep trusting a revoked chain until someone ships them a new bundle.

Mozilla went further than a one-time block. It removed emSign ECC Root CA – G3 from NSS 3.131.1 on October 20 so applications that borrow Mozilla’s list, and never see OneCRL, drop the whole root. Chrome committed to the same removal in Chrome Root Store version 43. Mozilla is keeping the older RSA root, emSign Root CA – G1, for now. Chrome has said it is still looking at that one.

Curl, Java and Frozen Devices Still Trust the Chain

Helme minted a certificate for api.stripe.com with one of the broken intermediates and pointed curl, Python and Node at it on Linux and macOS. Default settings accepted the chain. Curl printed “SSL certificate verify ok.” That is the specimen that matters for operators who do not live in a browser. Jackson’s live checker for unpatched TLS clients now serves the same chains, including copies that were never logged to CT, so a successful handshake means the client still trusts the keys and does not enforce CT.

WHO STILL ACCEPTS A FORGED CHAIN

• Install scripts: curl-to-shell installers and self-updaters fetch code over HTTPS with no extra signature check, often as root.
• Build pipelines: GitHub and GitLab runners, Jenkins and build containers pull packages on stale images while holding cloud keys and signing tokens.
• Server APIs: payment webhooks, OAuth token posts and cloud CLIs that ship their own cert bundle, including Python’s certifi, talk TLS without CT.
• Frozen firmware: cameras, routers, payment terminals and industrial controllers keep a CA list until the device dies; Helme notes some of these intermediates last until July 2039.
• Code signing: Windows trusts the eMudhra code-signing chain directly, so malware signed by EM OV CS CA – G3B or G3C can look like a real publisher to anything that skips revocation.

Go shipped 1.27.3 and 1.26.10 on an urgent track as CVE-2026-111943. Python’s certifi 2026.10.19, NSS 3.131.1, rustls webpki-roots 1.0.10, Node patch releases, Java CPU updates and a long list of Linux ca-certificates packages now reject the chains. Machines that are not rebuilt, and appliances that cannot be, do not get that help. Helme also found that a single prompt to an AI agent recovered the same private keys. The integer 4 was never a four-digit PIN; it was the whole secret, and it had been sitting in a public database since May 2025.

Why a 1% Line Cost a Third of the Share Price

Global SSL/TLS, eMudhra says, is about 1% of group revenue, squeezed by data-sovereignty rules, extra compliance cost, and large players that give certificates away. Srinivasan said many CAs live on SSL alone, while for eMudhra it is one slice of a wider digital-trust set that includes CertiNext, SecurePass and document signing. The board still treated the week as a reason to leave the line, and the market treated the week as a reason to sell the whole company.

THE THREE-SESSION SHARE SLIDE

That is a 1% revenue line priced as a trust event. eMudhra has estimated that about 30,000 certificates chained to the ECC G3 root need to move onto the RSA G1 root that Mozilla is still carrying. The company says it will replace customer certificates at no cost through partners, keep revocation and status services up until every issued certificate expires or is swapped, and file a full root-cause report with the browser programs. G1 RSA issuance continues through that hand-off. New issuance under the G3 chain has already stopped.

However, the level of social media amplification around this incident has brought scrutiny that is out of proportion to SSL/TLS’s place in our business. In view of this, after detailed deliberations our board has concluded that withdrawing from global SSL/TLS is the right decision for eMudhra and its shareholders.

V. Srinivasan, Chairman, eMudhra press release, October 22, 2026

Srinivasan also told interviewers the firm has to work on reputation in the short to medium term, and that if this incident can happen to eMudhra it can happen to anybody. The share slide says buyers were not pricing a 1% product cut. They were pricing a CA that generated single-byte keys, missed them in its own checks, and then described a multi-vendor block as an online pile-on.

The India Stack That Delhi Wants to Protect

eMudhra is one of the certifying authorities licensed by the Controller of Certifying Authorities under the Ministry of Electronics and Information Technology. That licence covers Digital Signature Certificates and eSign used on government and private paperwork, including work tied to UIDAI’s Aadhaar stack and the income tax portal. The company says that Indian DSC and eSign kit is physically and logically separate from the global TLS roots, and that those services are running as normal. Enterprise PKI products (emCA and CertiNext), emSigner, and identity tools SecurePass and emAS are in the same “not affected” list.

MeitY constituted a special team after the disclosure. It said the incident belongs to the international, browser-trusted function, which is audited under WebTrust by BDO International Limited and is not audited by the ministry. Indian DSC and eSign, it said, remain completely unaffected. Impact on Indian websites and applications, in the ministry’s words, was very limited and for a very short interval. It also said some social media accounts were indulging in fear-mongering. CERT-In published a matching warning the same week as advisory CIAD-2026-0050, telling departments and operators that an attacker who recovered the keys could issue fraudulent TLS certificates and intercept traffic where those chains were still trusted.

CERT-In has published Advisory on its website.

Compromise of eMudhra Intermediate CA Certificateshttps://t.co/gixbWR83Vf

— CERT-In (@IndianCERT) October 21, 2026

The CERT-In advisory on the eight certificates is the domestic paper trail. Internet Freedom Foundation wrote to eMudhra, CERT-In and MeitY asking for an incident report, an independent audit and a regulatory inquiry, citing the private key of 4 in the title of that letter. MeitY has said further details will come when its investigation is complete. Srinivasan said government advisories also came back, after questions to the company, with no impact on that ecosystem, and that he does not see the reputational hit spreading into Indian government work. The probe is the test of that claim, not the press release.

Chrome Removes the G3 Root on October 27

Chrome Root Store version 43 is due to reach devices on the morning of Tuesday, October 27, 2026, Pacific time, without emSign ECC Root CA – G3. Sites that still present a G3 chain to Chrome after that cutover will fail in that browser even if the leaf itself was honestly issued. Firefox users on current NSS already fail closed. The RSA G1 root remains the bridge eMudhra is offering for the roughly 30,000 certificates it wants migrated, and for the rest of the installed base until those leaves expire.

That is a clean story for anyone who updates Chrome or Firefox. It is not a clean story for the copies of the eight keys that have been public since May 2025, or for the firmware lists that will still honour them into July 2039. eMudhra can leave the global TLS business, and it can keep selling eSign in India on other hardware. It cannot put the integer 4 back in the box.

Disclaimer: This article is news reporting on a company announcement, a certificate-authority incident and related share-price moves, and it is for information only. It is not investment advice, not a recommendation to buy or sell eMudhra or any other security, and not a substitute for professional security, legal or financial advice. Readers who hold the shares, operate systems that trust emSign or eMudhra roots, or must meet Indian CA rules should consult a qualified financial adviser, a security engineer responsible for their trust store, and, where relevant, legal counsel before acting. Prices, browser blocks, certificate status and the MeitY inquiry are as given by the cited company, market, browser and government sources on the dates named above and can change.