eMudhra Private Keys: What a Key of 4 Means for the Files You Upload

On October 17, 2026, a researcher showed that eight eMudhra private keys were whole numbers below 256, and one was simply 4. eMudhra is an Indian certificate authority (a company your devices trust to vouch for websites) that Chrome, Firefox, Apple and Microsoft trusted.

eMudhra's weak keys could let someone pass a fake website off as the real one. If you upload work files to websites and AI tools, the real worry is whether those files were exposed.

The answer depends on which software sent your files, and on October 22 some Mac tools still trusted the weak keys.

eMudhra Private Keys: Found on October 17, Blocked by October 20

A researcher found the flaw at 16:27 UTC on October 17, 2026, and Chrome, Firefox, Apple and Microsoft had blocked the certificates by October 20.

Named only as Wayne, the researcher found it while scanning the CCADB (a shared public database of certificate authorities). He proved it by signing the message "We have a problem here - Wayne" with each of the eight keys, then at 18:05 UTC emailed Apple, Chrome, Microsoft, Mozilla and eMudhra.

All eight are intermediate certificates (the middle link between a trusted root certificate and a website's certificate). Six vouch for websites and two for software makers, all made on April 30, 2025. This eMudhra certificate compromise was no theft: "nobody had to steal anything," security researcher Scott Helme writes.

eMudhra says in Mozilla's bug report that a script flaw made a second, weak set of keys, used "because the key labels were similar". In mid-2025, its lists of cancelled certificates failed checks and were re-signed "with flawed keys". Chrome has asked why eMudhra re-signed them instead of checking why two sets of keys existed.

• eMudhra says seven of the eight were never used in production, and the eighth "had not issued a single certificate".
• eMudhra also says its security controls "remained intact" and the affected website-certificate business is "around 1%" of its revenue.
• eMudhra's status page says the flaw "went undetected for about 18 months, through two independent audit cycles".
• On October 20, Mozilla removed eMudhra's root, "emSign ECC Root CA - G3", from its trusted list.

A Key of 4 Breaks the Padlock's Identity Check, Not Its Scrambling

A key of 4 lets anyone sign certificates in eMudhra's name, breaking the padlock's check on who is at the other end while its scrambling still works.

HTTPS, the padlock on a web address, does two jobs: it scrambles what you send, and it checks that the other end is the real site. A certificate authority is a company your device trusts to vouch for a site's identity. Cloudflare says the fixes concern that identity check, not the encryption itself.

A private key is the secret number a certificate authority signs with. eMudhra used P-384 keys (a common key type). Each should be a random number up to 116 digits long. eMudhra's eight private keys were 4, 56, 66, 115, 155, 156, 230 and 237.

How we checked: we built the timeline above from Mozilla's bug report, Google's and Mozilla's posts and eMudhra's statements, read on October 22, 2026. That day we also ran a short program over the 16 public certificates (two per key), trying 1 to 255 as the key. It found all eight keys, matching Helme's list.

• Every certificate we checked still claims a 384-bit key, though Ars Technica found the real keys used only 3 to 8 bits (binary digits).
• Helme notes that "every structural check passes. The only way to find out is to try."
• Google says the keys were "generated with insufficient randomness", meaning they were not random enough.
• Mozilla's trusted list, read on October 22, holds 169 root certificates from 50 owners. Google says weak keys at just one let anyone forge certificates "to impersonate any website" in software that still trusted them.

Browsers Were Protected, but Some Apps and Devices Were Not

Up-to-date Chrome and Firefox were protected from October 17, 2026, and Safari and Apple's own certificate checks from October 19, but apps, Mac Terminal tools and devices with their own certificate list were not.

Chrome, Firefox and Safari require Certificate Transparency (CT, a public log of trusted website certificates). No certificates signed with the six website keys were logged before Chrome's block, so Google says no forged one could have worked in browsers that check the log.

Outside the browser, many apps and devices trust a certificate list on disk and check neither cancelled certificates nor CT, Helme writes. On a Mac, that includes the built-in Terminal tools (command-line programs) such as curl and git. The disclosure site from Mozilla's Dennis Jackson says they read a file that "has not been updated".

Forged certificates need a man in the middle attack (someone between you and the site). Ars Technica notes this is far easier for whoever controls a local network "at a coffee shop, university, or other organization". Helme says the keys sat in plain sight for 17 months, and nobody can know if anyone found them.

• We ran nothing on a Mac. One developer reported on October 21 that macOS's built-in curl connected to two test sites using the weak keys, while the one from Homebrew (a popular developer tool installer) refused them.
• Cloudflare "has not identified active exploitation" on its services, and eMudhra says it is "not aware of any evidence" of their use before the disclosure.
• Cryptography engineer Filippo Valsorda told Ars Technica the clean-up will be "bigger than Heartbleed" (a 2014 web security flaw), a forecast rather than measured harm.
• In 2011, by contrast, an intruder at the certificate authority DigiNotar issued 531 fake certificates, and over 99% of about 300,000 internet addresses that checked one were in Iran.

AI Recovered eMudhra's Weak Keys in One Prompt, Without Breaking Encryption

On October 18, 2026, Mozilla's Dennis Jackson wrote that local AI agents (AI programs that carry out tasks) recovered eMudhra's private keys on their first attempt with a simple prompt.

Scott Helme added on October 20 that Claude, Anthropic's AI assistant, "was able to recover the private keys with a single prompt". eMudhra's statement says the keys could possibly be reverse-engineered with AI-assisted techniques. Wayne's own timeline says he started playing with some new toys 27 minutes before the find, and it never mentions AI.

Keys this small need no AI. Helme writes that anyone who looked "at any point since April 2025" could have recovered the key "in milliseconds" on ordinary hardware. We ran our check in plain Python (a common programming language), with no AI, on a Linux cloud machine: it took 561.6 milliseconds in total.

So AI agents found the tiny keys on the first try, but a plain loop with no AI is just as fast. No strong encryption was broken. We think that as AI improves at hacking, flaws in public data will be found faster.

• Jackson's prompt said only that he was doing a CTF (a practice hacking contest) and asked the agents to "recover the private keys corresponding to these certificates".
• Mozilla recovered the keys on its own at 21:48 UTC on October 17, and by October 20 "multiple individuals" had done the same.
• Google says it checked every key in its trusted root lists and found no other with the same flaw.
• eMudhra says it checked its other issuing certificates mainly with "mathematical models" helped by AI, and plans to "adopt AI based tooling".

Five Steps to Take on Your Mac Now

Five plain steps keep a Mac safer now, and the firmest is to never click through a certificate warning, above all after October 27, 2026, when Chrome plans to drop eMudhra's root.

Updates fix the browser side. But Cloudflare warns that "A successful browser test does not prove that a background service is protected." The steps below also cover apps and tools that send files on their own.

• Chrome is due to drop eMudhra's root on October 27, and Google warns that some genuine certificates under it "will cease to function" in Chrome.
• Chrome counted about 30,800 unexpired certificates under that root, 99.9% issued by two InCommon certificate authorities that sit below that root.
• Mozilla shipped Firefox 158.0.1 on October 20 for people whose settings blocked the automatic update.
• Android phones got a matching block through Google Play Services on October 19, and restarting the phone applies it at once.

Elephas Is a More Private Way to Use AI on Your Documents

Anyone using cloud AI tools such as ChatGPT, Gemini and Claude also relies on systems they cannot see, and Elephas is built to send them less.

What ChatGPT, Gemini and Claude Receive

When you use ChatGPT, Gemini or Claude, every question you type and every file you upload goes to that company's servers to make the answer. Depending on your plan and settings, your chats can be kept and may be used to train their models.

Elephas Hides Personal Details Before a Cloud Model Sees Them

With Elephas, names, emails and phone numbers are hidden on your Mac before a cloud model sees them. Elephas AI runs open-source models in Elephas's own cloud, and your question and passages are not stored or used to train AI.

Elephas Local Models Send Nothing at All

With an Elephas local model, the answer is made on your Mac, so your questions and documents are not sent anywhere. It settles the local versus cloud AI choice in favour of local.

Elephas Team Sets One Privacy Policy

Team costs $29 per person per month. The Owner decides which models members may use and whether hiding personal details is required, and team sync is end-to-end encrypted (only your team's devices can read it).

• Every answer cites its source file and passage, so you can check it.
• Your files stay on your computer, with the search index and chats in an encrypted database.
• Runs on Apple Silicon Macs with macOS 14 or later. Plans start at $19 a month, with a 7-day free trial. Try Elephas.
• You can also use your own API key (an AI account code).

Conclusion

The eMudhra private keys never weakened the scrambling that protects your files. They broke the check on who is at the other end.

Browsers closed that gap within days, while apps, devices and Mac tools are still catching up. Chrome is reviewing eMudhra's remaining certificates, and its twelve questions to eMudhra were unanswered on October 22.

• Treat any certificate warning as a stop sign.
• Watch for eMudhra's promised full report on the cause.
• For AI work that needs more privacy, try Elephas, with hidden personal details, local models and team controls.

Written by

Selvam Sivakumar

Founder, Elephas.app

Selvam Sivakumar is the founder of Elephas and an expert in AI, Mac apps, and productivity tools. He writes about practical ways professionals can use AI to work smarter while keeping their data private.

LinkedInFollow