Weak eMudhra certificate keys revoked after browser vendors step in
eMudhra revoked eight intermediate certificates after a researcher found that their P-384 private keys were generated with values small enough to be recovered by trying only 256 possibilities. Mozilla, Google, and Apple added blocks for the certificates in Firefox, Chrome, and Apple platforms. eMudhra attributed the problem to a certificate-generation script error and said it found no evidence the certificates were used to issue customer certificates.
The flaw surfaced October 17 when researcher Wayne scanned public certificate records and spotted the weak keys. The eight intermediates had P-384 private keys created in April 2025 with values below 256, making recovery feasible by checking only 256 candidates. One published key for “EM OV TLS CA - G3C” equaled 4, and BleepingComputer confirmed it matched a revoked certificate.
eMudhra blamed a certificate-generation script error that produced a second, weaker key set; similar labels led those keys to be selected for signing. Some certificates were cross-signed by Sectigo. eMudhra said most affected intermediates were never used in production and no evidence showed they issued end-user certificates, though the keys could have been abused since April 2025.
The incident could affect website operators, browser users, and software relying on independent certificate stores. If a weak intermediate had been abused, attackers might impersonate trusted sites and intercept encrypted traffic, exposing credentials or sensitive data. Users of updated browsers and operating systems may be largely shielded, while embedded or unpatched software that ignores revocation could remain exposed. Organizations may need to verify certificate trust stores and apply vendor updates.