eMudhra cert private keys leaked — one 116-digit key was literally "4"

teortaxesTex · x · 2026-10-21

Mozilla disclosed that 8 certificate private keys from Indian CA eMudhra were compromised, with Firefox blocking them within 3 hours. Each key should be a 116-digit number, but one was just "4" — guessable by anyone, enabling HTTPS cert forgery for any website. The quip: fantasy security problems involve timing side channels via case vibrations; real ones are keys that fit in one digit.

Related event: Indian CA eMudhra issued 8 intermediate certs with trivially weak private keys(44 posts)→

Original post →

More from Fun

Fun channel →