Eight eMudhra CA Keys Recovered in Under a Second
Security researcher Scott Helme said he recovered all eight private keys for affected eMudhra intermediate certificates from their public certificates in under one second. The set comprised six TLS-issuing CAs and two code-signing CAs, all cross-signed by Sectigo's AAA Certificate Services root; Chrome, Firefox, Safari and Windows applied blocks, while Mozilla removed the eMudhra root from NSS. Helme also reported that Claude recovered the keys from a single prompt, although eMudhra attributed the weakness to a key-generation ceremony error and said only one affected intermediate reached production, with no end-entity certificates issued and the root private key uncompromised.
Six affected intermediates could sign TLS certificates, creating a broad certificate-fraud and trust-store exposure, while Helme's account that Claude recovered the keys with one prompt adds a notable AI-assisted security dimension.
One of eMudhra's certificate authority private keys is the number 4.
Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their public certificates on my laptop just now, and it took less than a second.
What happened
On Saturday 17th October a security researcher reported to Apple, Google, Microsoft, Mozilla and eMudhra that the private keys for eight eMudhra intermediate certificates were compromised. Chrome pushed a CRLSet update blocking them that evening and Mozilla blocked them in Firefox via OneCRL a few hours later. On Tuesday 20th, Mozilla announced it publicly and shipped an NSS update removing the eMudhra root, and Chrome confirmed the root is going in Chrome Root Store v43.
#eMudhra#Claude#Chrome#Firefox#Mozilla NSS#Apple Safari#Microsoft Windows#Sectigo AAA Certificate Services#emSign ECC Root CA - G3#Go