eMudhra CA compromise: eight private keys, and one of them is 4

What it is

Eight eMudhra intermediate CA certificates, all chaining to emSign ECC Root CA - G3, have private keys that anyone can recover from the public certificates. According to Aikido's analysis, every key is below 256 and one is 4. A researcher known as Wayne reported this to browser and OS root programs on 17 October 2026 and proved it by signing "We have a problem here" with each key. The certificates date from April 2025. Six of the eight were TLS intermediates and two were Microsoft-trusted code-signing CAs.

Preconditions / Affected

Browsers are covered through vendor revocation pushes: Firefox and Chrome since 17 October, Apple since 19 October, Microsoft since 20 October. Mozilla has removed the root, and Chrome expects to follow on 27 October.

Exposure is in software that checks no revocation data and trusts a static bundle:

• macOS built-in curl, git, python3, perl, ruby and openssl, which read /etc/ssl/cert.pem. Apple has not updated it yet.
• Linux tools that depend on the distribution's ca-certificates package.
• Docker images, which freeze the bundle at build time. As of 22 October, grafana/grafana:latest, mysql:latest, jenkins/jenkins:latest and bitnami/postgresql:latest were still affected.
• Runtimes with their own roots: Go, Java, Node.js, Python's certifi (fixed in 2026.10.18), Rust's webpki-roots.
• IoT firmware, likely vulnerable for years.

An attacker also needs a network position, such as hostile Wi-Fi or a compromised router. The incident site says the eight intermediates were absent from certificate transparency logs before the block, so clients enforcing CT (Firefox, Chrome, Edge, Safari) could not have been attacked. It does not know whether attackers used the keys against other clients.

What to do

Update the OS and browsers, update the CA bundle on servers and in images, then rebuild images and restart services. A running container keeps the old bundle.

Patched ca-certificates versions named on the page: Ubuntu 20260816ubuntu0.*, Debian 12 20250419~deb12u2, Alpine 20261020-r0, Fedora 2026.2.92_v9.0.319. The page warns that a single version cutoff misclassifies some distributions, so check the incident site's table. Regenerate the active trust store where the distribution requires it.

docker build --pull --no-cache

Check the installed version:

dpkg -s ca-certificates | grep Version   # Debian, Ubuntu
apk info ca-certificates                 # Alpine
rpm -q ca-certificates                   # Fedora, RHEL

Test whether a client still trusts the intermediates:

curl -sS -o /dev/null -w "HTTP %{http_code}\n" https://dv-g3b-emudhra.we-have-a-problem.com/
curl -sS -o /dev/null -w "HTTP %{http_code}\n" https://dv-g3b-aaa-emudhra.we-have-a-problem.com/

A patched client fails both with curl: (60) SSL certificate problem: unable to get local issuer certificate and prints HTTP 000. A 200 means the client still trusts them.

Caveats

The incident site publishes macOS workaround commands, but the page does not reproduce them. Patch status changes daily. Bundled runtimes each need their own release. Aikido flags images with old bundles as Critical (own bundle, such as certifi before 2026.10.18) or High (system trust store), and released Device Protection v1.10.20 as a hotfix. The cause of the small keys is unconfirmed: the page offers a byte-cast bug or old Go decimal-truncation behavior as theories.