When your browser shows a padlock, it's trusting a chain. Browsers trust a short list of root certificate authorities, roots vouch for intermediates, and intermediates sign the certificates for individual websites. Whoever holds an intermediate's private key can sign a certificate for any site they like.
On October 17, a researcher told Chrome, Mozilla, Apple, Microsoft and eMudhra, a Bengaluru-based certificate authority, that the private keys of eight of its intermediates could be worked out from the public certificates. As proof, he sent a message signed with each of the eight keys.
The flaw was almost embarrassingly simple. These were P-384 elliptic curve keys, where the private key should be a random number around 384 bits long. Each one was a number below 256, and one was literally 4. Anyone can take the public key, try small numbers until one matches, and finish in well under a second. Mozilla recovered them itself in under four hours, without any hints. eMudhra's own statement blames a script error during a key generation ceremony in April 2025, which means the keys were guessable for about 17 months before anyone said so.
Then the industry moved fast. Chrome had a block in place within two hours of the report, pushed silently with no browser update. Firefox followed the same day, and eMudhra revoked all eight the next day. Windows blocked them on October 20, Apple on October 22, and Microsoft followed with an emergency Windows update on October 26. Mozilla and Chrome also removed the parent root, emSign ECC Root CA - G3, with Chrome's removal landing on October 27.
eMudhra says its infrastructure wasn't breached and that none of the eight intermediates had issued certificates to real websites. Its shares still fell about 20% in a day, and on October 22 it decided to quit the global TLS certificate business, with the board citing risk to the rest of the company. Its Indian digital signature and eSign services, which are regulated separately, are unaffected. About 30,000 customer certificates still need replacing, and roughly 97% of them were issued through automated ACME, which is what makes a swap that big even possible.
A big reason this stayed contained is Certificate Transparency, a public log of issued certificates that browsers require. Chrome found no website certificates under the six TLS intermediates in those logs before it blocked them. But not all software insists on that check. Go shipped patch releases, Python's certifi, Rust's webpki-roots, Debian's ca-certificates and Java distributions like Temurin all had to drop the root, and JetBrains updated its IDEs. Debian and Ubuntu users had an extra trap, because their Java keystore doesn't refresh when the system trust store does.
The story isn't finished. eMudhra's older RSA root, emSign Root CA - G1, is still trusted by Mozilla, under review at Chrome, and being evaluated by Microsoft. It matters because institutions like Stanford's InCommon service chain to it.
What stuck with me is how much rests on the least careful link. What protected most people was a public log, not the authority's own care. If you run a site or build tools that call HTTPS APIs, find out who issued your certificates, and how fast you could swap them.