News: We now know how eMudhra broke its CA keys. They were not stolen. They were tiny numbers: 4, 56, 66, 115, 155, 156, 230 and 237. What happened: On Oct 17 a researcher named Wayne found he could recover the private keys of eight eMudhra intermediate CAs from their public certificates. He signed "We have a problem here - Wayne" with each key and sent it to the browser root programs. Mozilla rebuilt the keys on its own the same day. Who is hit: Six of the CAs issue TLS certs and chain to emSign ECC Root CA - G3, trusted by Chrome, Firefox, Apple and Microsoft. Two sign code. Sectigo cross-signed all eight under "AAA Certificate Services". How eMudhra got it wrong: These are ECDSA P-384 keys. A real one is a random number about 116 digits long. All eight were below 256, so you only need to try 255 values. eMudhra says that at an April 2025 key ceremony on Utimaco HSMs, it changed its usual steps to test key wrap/unwrap for export. A bug in its script made a second, weak set of keys. Staff then used the weak keys for the CSRs by mistake, because the key labels looked alike. eMudhra is still hunting the exact bug. Why browsers were safe: No certs from these CAs appear in CT logs, and Chrome, Firefox, Safari and Edge reject unlogged certs. eMudhra says none of the eight issued end-entity certs. But curl, scripts, apps and devices that skip CT and revocation checks could have been fooled since April 2025. No one knows if that happened. What to do now: - Update ca-certificates (Ubuntu, Debian, Fedora, Alpine, Arch) - NSS 3.131.1, Firefox 158.0.1 - Go 1.27.3 or 1.26.10, certifi 2026.10.19, pip 26.2.2, uv 0.13.4 - Node.js and Bun: fix pending - macOS /usr/bin/curl still uses the old /etc/ssl/cert.pem - Sites on emSign ECC Root CA - G3: Chrome drops that root Oct 27. Get a new cert now. eMudhra says about 30,000 certs must move. bugzilla.mozilla.org/show_bu…