Certificate authority eMudhra has revoked eight compromised intermediate certificates after researchers discovered that private keys were extremely weak and could be easily recovered.
The weakness could have allowed attackers to create trusted certificates for fake websites, impersonate legitimate sites, and intercept encrypted communications.
The issue was discovered on October 17 during a scan of public certificate data. According to Mozilla, all eight certificates used private keys with values smaller than 256, meaning attackers needed to test only 256 possible numbers to recover them.
A security researcher demonstrated the problem by publishing one of the private keys on GitHub. The key for eMudhra's “EM OV TLS CA - G3C” certificate had a value of just 4.
eMudhra blamed the issue on a scripting error in April 2025 that caused weaker keys to be generated and mistakenly selected for certificate signing. The company said most affected certificates were never used in production and that it had found no evidence they were used to issue certificates to end users.
Following the discovery, eMudhra revoked all eight certificates and stopped issuing new certificates under its G3 root. Mozilla, Google, and Apple also blocked the affected certificates to protect users.
Mozilla later released additional Firefox updates on October 20. The Go development team also issued security updates to address the vulnerability, tracked as CVE-2026-111943.
Although major browsers have added protections, some software may continue to trust the compromised certificates if it does not check for revocations or use updated security systems. There is currently no evidence that attackers exploited the weak keys.