Browsers Block Eight eMudhra Certificates With Tiny 3- to 8-Bit Keys

Major browser vendors and app makers blocked eight intermediate TLS certificates from eMudhra after a researcher proved control of their compromised private keys.

Threat Times Intrusion DeskOctober 21, 20262 min read

Share LinkedIn Reddit

Illustration: A web browser window sits on a desk, displaying a red warning triangle on a blank page. — AI-generated illustration: Threat Times

Key points

Eight eMudhra intermediate certificates had private keys of only 3 to 8 bits.
Browser makers and major apps blocked the certificates following the discovery.
Security personnel remain on high alert due to the trust implications.

Major browser vendors and application makers have blocked eight intermediate TLS certificates issued by eMudhra. This action follows a researcher’s demonstration of control over the private keys associated with these certificates, according to Techmeme reporting on the Ars Technica article.

The compromised certificates possessed private key sizes ranging from just three to eight bits. This extreme weakness allowed the researcher to prove effective control of the keys. The discovery triggered immediate blocking actions by browser makers and major applications to address the security risk, as noted in the Techmeme summary.

Certificate Vulnerability Details

The incident involves eight specific intermediate TLS certificates from the Indian certificate authority eMudhra. The private keys for these certificates were exceptionally small, measuring between 3 and 8 bits in length. Standard security practices require much larger key sizes to ensure cryptographic strength. The researcher demonstrated that they could control these keys, which raised significant concerns about forged SSL trust, according to previous Threat Times reporting on October 21, 2026.

Threat Times previously reported that major browser vendors blocked these eight intermediate certificates after the researcher proved key compromise. That earlier coverage highlighted the immediate response from the industry to the demonstrated vulnerability. The current reporting confirms that the keys involved were of minimal bit lengths, specifically between 3 and 8 bits, which is far below secure standards.

Impact on Trust and Security

Security personnel around the world are on high alert following this discovery. The blocking of the certificates by browser makers and major apps indicates a coordinated effort to mitigate the risk. The incident raises broader concerns about the integrity of the public key infrastructure and the trust placed in certificate authorities.

The fact that private keys of such small sizes could be issued and compromised suggests potential failures in issuance controls or key management practices. While the exact cause of the tiny key sizes is not detailed in the current material, the result is a breach of trust that required immediate remediation through blocking. The industry response underscores the critical nature of certificate validation.

What should you do?

Readers should verify the status of their own certificate deployments. Organizations relying on TLS certificates should ensure they are not using any intermediates from eMudhra that may be affected. Monitoring vendor announcements for further updates is essential.