On 17 October, a researcher told major browser makers that eight secret keys belonging to eMudhra had been cracked. eMudhra is an Indian company that helps the internet decide which websites to trust. When the news spread, many headlines spoke of an internet meltdown. So how dangerous was the flaw, really?
The short answer: it was a serious mistake, but so far the damage looks limited. Here is why.
To understand the flaw, it helps to know what eMudhra does. When you open a website, your browser wants proof that it is talking to the real site and not a fake one. That proof is a digital certificate, which works like an ID card for a website. Companies called Certificate Authorities issue these cards, and eMudhra is one of them.
Authorities often use intermediate certificates, which act like authorised officers who can issue cards on the main authority’s behalf. Browsers trust anything signed by an intermediate, as long as it traces back to a trusted root.
Each certificate is protected by a private key, a secret number. Whoever holds the key can sign certificates in that authority’s name. That is why such keys must be impossible to guess.
So what exactly went wrong? The problem sat in eight intermediate certificates created on 30 April 2025. Their keys were meant to be P-384 keys, picked from a range of roughly 10^115 values. That is a 1 followed by 115 zeros.
Instead, the keys were tiny numbers below 256. One of them was the number 4. With so few options, a basic computer can try them all. Researchers recovered all eight keys in under a second, and Mozilla’s engineers recovered them on their own within two hours of receiving the report.
No break-in was needed. The keys could be worked out from the certificates themselves, which are public.
eMudhra says a flaw in its April 2025 key-generation process created a second, weak set of keys alongside the intended ones, and the weak set was used by mistake.
Why does this matter? With such a key, an attacker could create a fake certificate for any website, and browsers that still trusted these certificates would accept it as genuine. You might think you were on your bank’s website while talking to a criminal’s server, which could then read or change your data.
There is one catch. To use a fake certificate, an attacker would still need to intercept your connection, for example through a hacked Wi-Fi network.
Still, the real risk looks lower than the headlines suggest. The flaw was caught and blocked quickly. A researcher’s report reached Mozilla on 17 October through Chrome’s root program, and Apple, Microsoft and eMudhra were told as well. Firefox and Chrome blocked the affected certificates that day, Apple followed on 19 October and Microsoft on 20 October.
No attacks have been reported. Google said no website certificates from the six intermediates that issue them had been logged in public Certificate Transparency logs, which are open records of issued certificates, before it blocked them.
eMudhra says its root keys and its other intermediate certificates are not affected. It says only one of the eight was ever put into production, and that no certificates were issued to end users from any of them. It has revoked all eight and stopped issuing new certificates under the affected G3 root.
That does not mean experts are relaxed. First, time. The keys were weak from the day they were created, and the flaw was reported only in October 2026, about 17 months later. No evidence of misuse is good news, but it is not proof that nothing happened.
Second, cleanup. Some non-browser software, such as developer tools and containers, may not check whether certificates have been revoked. Administrators may need to update such systems by hand, including custom trust stores.
Third, fallout. On 20 October, Mozilla removed trust in eMudhra’s affected G3 root, and Chrome plans to follow in a release expected on 27 October. eMudhra estimates that about 30,000 certificates will need to be moved.
Fourth, trust. Mozilla has opened a public incident report with questions for eMudhra. How such a basic mistake went unnoticed for so long remains the biggest question.
So what should you do? For most people, the answer is simple: keep your browser, phone and apps updated. Browser makers have already blocked the certificates, so you do not need to change any certificate settings yourself.
So, how dangerous was it? Think of it as a master key that was cut badly and was easy to copy. But so far, there is no sign that the key opened any doors.
Browser makers acted within days, and the affected certificates have been revoked. So far, this looks like a serious failure with a fast response, not an internet meltdown. For eMudhra, though, the consequences are real.
The bigger lesson is about trust. The internet depends on a small number of organisations to vouch for websites. When one makes a basic mistake, the whole system has to check itself. This time, the safety net worked.
Subscribe Deshwale on YouTube
