{"rewrite":{"id":"r_70dee12f370b6803f561bfbe","clusterId":"c_ff8ac98dd428358c2cab801b","slug":"eight-emudhra-intermediate-ca-keys-recovered-from-their-own-certificates","model":"deepseek-v4-1-flash","headline":"Eight eMudhra Intermediate CA Keys Recovered From Their Own Certificates","summary":"Eight eMudhra intermediate CA private keys were compromised, and the certificates chained to roots trusted by Mozilla, Microsoft, Apple, and Chrome programs and many downstream trust stores. The reporter signed messages with each key and notified root program teams on October 17, 2026. Firefox and Chrome blocked the certificates that day, Apple on October 19, Microsoft on October 20. eMudhra revoked the intermediates. The keys were recoverable because the CA generated them improperly, and all eight were one byte, one of them \"4\".","whyItMatters":"The eight keys were one byte each and generated improperly by the CA itself, which means a root program's trust in eMudhra intermediates rested on private keys that could be read straight out of the certificates, and blocking them depends on revocation data that many clients do not yet apply.","webCardHtml":"\u003cp\u003eThe intermediate certificates were created in April 2025, and the private keys could be recovered from them because eMudhra generated the keys improperly. According to information circulating on Hacker News, all eight were a single byte, and one was the value \u0026#34;4\u0026#34;.\u003c/p\u003e\u003cp\u003eRevocation alone does not close the gap. Many clients do not recognize revocation information immediately, so software updates are needed before a client stops trusting the compromised intermediates. Mozilla, Microsoft, Apple, and Chrome distribute revocation data through OneCRL, CRLite, and CRLsets. An attacker holding the keys could impersonate any website or service until the intermediates were revoked. There are no Certificate Transparency log records for the intermediates in the relevant period, which affects clients that enforce CT.\u003c/p\u003e","blueskyPost":"Eight eMudhra intermediate CA private keys were compromised, all one byte, one of them \"4\". Root programs blocked the certs between Oct 17 and Oct 20; eMudhra revoked them. Clients that don't apply revocation data need software updates.","twitterPost":"Eight eMudhra intermediate CA private keys were compromised. All were 1 byte, one was \"4\". Firefox and Chrome blocked the certs Oct 17, Apple Oct 19, Microsoft Oct 20. eMudhra revoked the intermediates; clients still need updates to act on it.","threadsPost":null,"newsletterBlurb":"Eight eMudhra intermediate CA private keys turned out to be recoverable from the certificates themselves, all one byte each, one of them the value \"4\". The intermediates chained to roots trusted by Mozilla, Microsoft, Apple, and Chrome, and the reporter signed messages with each key before notifying root programs on October 17. The certs are blocked, but many clients need software updates before they stop trusting the compromised intermediates.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20261022-emudhra-problem/\",\"title\":\"All eight certificate authority private keys compromised at eMudhra were just \\\"1 byte\\\" each, with one private key being \\\"4\\\", chaining to roots trusted by Mozilla, Microsoft, Apple, and Chrome root programs and many downstream trust stores\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4709,"outputTokens":713,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1792620425,"createdAt":"2026-10-21T22:01:35.000Z","publishedAt":"2026-10-21T22:06:05.000Z","updatedAt":"2026-10-21T22:06:05.000Z"},"cluster":{"id":"c_ff8ac98dd428358c2cab801b","canonicalTitle":"eMudhraで侵害された8つの認証局すべての秘密鍵はなんとたった「1バイト」で秘密鍵の1つは「4」、Mozilla・Microsoft・Apple・Chromeのルートプログラムや多くの下流トラストストアによって信頼されているルート証明書に連鎖","representativeArticleId":"a_c1925d5d4a86683827af7db3","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-10-21T21:00:00.000Z","lastSeenAt":"2026-10-21T21:00:00.000Z","updatedAt":"2026-10-21T22:06:08.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20261022-emudhra-problem/","title":"eMudhraで侵害された8つの認証局すべての秘密鍵はなんとたった「1バイト」で秘密鍵の1つは「4」、Mozilla・Microsoft・Apple・Chromeのルートプログラムや多くの下流トラストストアによって信頼されているルート証明書に連鎖"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":null}