2026-10-21 / Signal #3
An Indian certificate authority’s private key was the number 4
“The private key that could impersonate any website was just… 4.”
The Story
Eight eMudhra intermediate CA private keys were so weak they could be recovered from public certificates in milliseconds; one was literally the number 4, others were 56, 115, etc. Browsers blocked them within hours. The keys could have let anyone mint trusted HTTPS or code-signing certs. No rogue certs found in CT logs so far.
Why It Matters
The skeleton key to the web was a single-digit number. Trust, institutions, and the absurd object at the heart of “secure connection.
Evidence
Scott Helme analysis, The Register, Mozilla/Chrome actions (Oct 17–21). Primary URL: https://www.theregister.com/security/2026/10/20/indian-certification-authority-emudhras-private-keys-compromised-one-of-them-was-the-number-4/5304312
Sources
Daily scan: 2026-10-21