eMudhra weak keys allow instant certificate forgery and slow patching

On October 19, 2026, Cloudflare identified a critical security failure involving eMudhra, a certificate authority that generated eight intermediate private keys with negligible entropy. Instead of using complex, unpredictable numbers, eMudhra used simple integers like 4, 56, and 237, allowing anyone to reconstruct the private keys from public certificates. This unprecedented vulnerability enables attackers to forge valid TLS certificates for any domain, bypassing standard encryption protections for unpatched clients.

What happened

The core issue stems from a catastrophic error in eMudhra’s key generation process. A certificate authority is trusted to select a massive, random number to serve as the foundation for its cryptographic security. In this case, eMudhra selected single or double-digit numbers. Because these values are so small, an attacker can recover the private signing key almost instantly using only the public certificate. This differs fundamentally from past CA breaches, such as DigiNotar or TrustWave, where stolen keys were protected assets accessible only to specific threat actors. Here, the keys are mathematically trivial to derive by anyone with basic tools.

Cloudflare responded immediately by patching its high-impact systems, including Pingora proxies, within hours of the discovery. They employed AI-assisted code analysis to identify all internal systems trusting these weak keys, assigning remediation tickets based on risk level. To monitor real-world exploitation, Cloudflare added logging to detect handshakes involving the compromised keys. Within a week, they recorded approximately 22,000 attempted handshakes. While most were benign tests or self-signed configurations, about 160 attempts involved forged certificates naming unrelated domains, including consumer IoT devices. These forgeries appeared within hours of the vulnerability becoming public, though no successful interception of Cloudflare traffic was detected.

To assess global vulnerability, Cloudflare deployed probe connections via their challenge pages, testing whether visitor browsers accepted certificates signed by the weak keys. The data reveals a troubling lag in patching adoption. While modern desktop browsers have largely updated, embedded systems like Android WebView still accept the compromised chains at rates of 30–40%. Furthermore, more than half of probes across major networks continue to trust the invalid certificates, indicating that a significant portion of the internet remains exposed to potential man-in-the-middle attacks.

Key details

• eMudhra used extremely weak integers (4, 56, 66, 115, 155, 156, 230, 237) for eight intermediate private keys.
• Private keys can be recovered instantly from public certificates, enabling unrestricted certificate forgery.
• Cloudflare observed roughly 22,000 handshake attempts using the weak keys within one week of disclosure.
• Forged certificates were created as early as October 20, less than an hour after Mozilla published the bug report.
• Over 50 million probes indicate that many embedded browsers and bots still trust the compromised certificate chain.
• eMudhra has announced its exit from the public CA business but has not released the flawed key generation script.

Background

Certificate Authorities (CAs) are trusted third parties that issue digital certificates to verify the identity of websites. These certificates rely on public-key cryptography, where a private key signs data and a public key verifies it. The security of this system depends entirely on the private key remaining secret and being generated with high entropy, meaning it is chosen from a vast pool of possible numbers. If the number is predictable or small, the mathematical relationship between the public and private keys becomes easy to reverse.

In this incident, the lack of entropy meant the "lock" protecting the internet’s trust model was effectively left open. Any actor could generate a valid certificate for a target domain, such as a banking site or internal corporate portal. Clients that do not enforce Certificate Transparency or fail to check revocation lists will accept these forged certificates as legitimate, allowing attackers to decrypt and modify traffic without triggering browser warnings.

Why it matters

For teams managing self-hosted infrastructure or internal services, this incident highlights the fragility of implicit trust in external CAs. Even if your organization does not use eMudhra directly, your employees’ devices, mobile apps, and IoT endpoints might still trust the compromised root or intermediate certificates. If an attacker forges a certificate for your internal domain, unpatched clients could connect to a malicious server believing it is your legitimate service. This risk is particularly acute for legacy systems, embedded devices, and automated bots that do not receive regular security updates.

The slow patching rate among embedded browsers and network-level clients suggests that vulnerabilities in the supply chain persist long after disclosure. IT leads must assume that some portion of their user base remains vulnerable to certificate spoofing. Relying solely on browser updates is insufficient; organizations need active monitoring to detect anomalous certificate usage and ensure their own services reject weak or revoked credentials explicitly. This event underscores the need for dynamic trust stores that can revoke bad actors quickly, rather than relying on static lists that take months to propagate.

What you can do

• Update all operating systems, browsers, and embedded software to the latest versions to ensure weak roots are distrusted.
• Configure servers to enforce strict certificate transparency and reject certificates from known compromised CAs.
• Monitor logs for TLS handshakes involving eMudhra intermediate keys to detect potential interception attempts.
• Audit internal applications and IoT devices to confirm they do not hardcode trust for the affected eMudhra keys.
• Follow crowdsourced remediation guides, particularly for macOS developers who may need manual trust store adjustments.
• Implement automated alerts for certificate changes on critical domains to spot unauthorized issuances quickly.