Eight Bits of Trust: eMudhra's CA keys cracked in milliseconds
- ID
- 37844
- Status
- summarized
- Published
- 21 Oct 2026, 5:08 PM
- Fetched
- 22 Oct 2026, 5:17 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://scotthelme.co.uk/eight-bits-of-trust-emudhras-ca-keys-cracked-in-milliseconds/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.5
- Created
- 22 Oct 2026, 5:18 AM
- Tags
- Audience
- developerssaas_founders
What happened
Scott Helme reports that eight eMudhra intermediate CA private keys were single-byte P-384 values (4, 56, 115, etc.), recoverable from public certificates in under a second; the intermediates were created in April 2025 — six TLS issuing CAs across DV/OV/EV and two code-signing CAs — and cross-signed by Sectigo's AAA root in May 2025. After a researcher reported the compromise on Saturday 17 October, Chrome blocked them via CRLSet that evening and Firefox via OneCRL hours later; Mozilla publicly announced on Tuesday 20 October and shipped an NSS update removing the eMudhra root, with Chrome Root Store v43 to follow.
Why it matters
If your TLS or code-signing chain includes one of these April-2025 eMudhra intermediates or a Sectigo AAA cross-sign, replace it before the Chrome Root Store v43 and Firefox NSS removals propagate; bundled trust stores or pins that still include eMudhra will keep trusting a root browsers are dropping, while public clients will start failing those chains.
Discussion angle
Ask which of your services use bundled or pinned trust stores rather than the OS/browser store — those are the ones that will not automatically drop eMudhra when Chrome v43 and Firefox NSS do.